[论文解读] Accompanist: A Runtime for Resilient Choreographic Programming

Viktor Strate Kløvedal, Dan Plyukhin+2 more|arXiv (Cornell University)|Mar 21, 2026

Distributed systems and fault tolerance被引用 0

一句话总结

Accompanist 提供面向 Chor al 编排程序的韧性运行时，通过部署回放计算的 sidecar 来掩盖故障，从而实现具有形式化正确性保障的去中心化 Saga 交易。

ABSTRACT

In service-oriented architecture, services coordinate in one of two ways: directly, using point-to-point communication, or indirectly, through an intermediary called the orchestrator. Orchestrators tend to be more popular because their local state is a 'single source of truth' for the status of ongoing workflows, which simplifies fault recovery and rollback for distributed transactions that use the 'saga' pattern. But orchestration is not always an option because of hardware constraints and security policies. Without a central orchestrator, resilient saga transactions are hard to implement correctly. A natural idea is to use choreographic programming, a paradigm that brings the 'global view' of orchestrators to a decentralised setting. Unfortunately, choreographic programming relies on strong assumptions about network reliability and service uptime that often do not hold. Recent work weakens some of these assumptions with 'failure-aware' language features, but these features make programs more complex. We propose a complementary approach: to co-design the programming interface with a customizable runtime that can replay computation to mask faults. Our approach keeps programs simple, does not require modifying the compiler, and lends itself to a clean separation of concerns in formal proofs. We present Accompanist, a resilient runtime for the Choral choreographic programming language. With Accompanist, programmers can implement decentralised saga transactions as choreographic programs and deploy the compiled code to 'sidecars' that run alongside services in a pre-existing codebase. Our key assumptions are that choreographic programs should be deterministic, transactions within a saga should be idempotent, and messages should be written to a durable message queue. Based on these assumptions, we present a formal model and prove that target code is correct-by-construction.

研究动机与目标

• 在无法进行编排的服务导向架构中，由于延迟、安全性或本地性约束，动机需要韧性协调。
• 介绍 Accompanist，作为与容错执行模型共同设计的编程接口的运行时，用于 Chor al 编舞的韧性执行。
• 表明用 Accompanist 实现的编舞 Saga 能实现无死锁、在有界重启下终止，并通过补偿事务保持一致性。
• 提供一个形式化模型和正确性结果，将编舞证明与网络层等价性证明分离。

提出的方法

• 给出一个分布式、从构造上就正确的编舞编程 saga 交易的形式化模型。
• 描述 Accompanist 的运行时架构，侧车运行 Chor al 生成的代码并通过可编程通道进行通信。
• 将基于会话的执行映射到轻量级虚拟线程，具备每个会话状态与乱序消息缓冲。
• 使用收件箱/发件箱模式实现持久化消息传递，以实现至少一次回放容错与幂等性事务。
• 引入容错模式，在该模式下重启会话并从初始状态重新回放，利用确定性和幂等性假设。
• 演示 Saga 交易通过 Transaction 接口和补偿动作来表达，在发生故障时确保回滚。

Figure 1 . A workflow with three services, implemented in three different styles.

实验结果

研究问题

• RQ1 如何在不需要编译器变更或侵入性语言扩展的情况下，使编舞编程在真实系统中变得可行？
• RQ2 回放式运行时方法是否能在保持死锁自由和 Saga 安全等正确性属性的前提下，为去中心化编舞提供韧性？
• RQ3 相较于传统 Saga 编排，Accompanist 的容错回放对性能的影响如何？
• RQ4 如何进行从构造上正确的去中心化编舞的正确性证明，并通过 bisimulation 将其与网络层行为联系起来？
• RQ5 在基于 sidecar 的编舞中，需要哪些机制（如消息头、会话管理）来支持可靠性与可观测性？

主要发现

• 默认的 Accompanist 模式在分布式部署中显著降低端到端延迟，尤其是在跨区域/区域的部署场景。
• 在容错模式下，Accompanist 相对于成熟的行业级 Saga 编排框架，在端到端中位延迟方面实现了显著的改进（中位端到端延迟降低约 5.9 倍）。
• 该方法提供了有原则的正确性结果：无死锁、在有界重启下终止，以及对参与方对成功或补偿动作的一致性。
• 提供了去中心化从构造上正确的 Saga 交易的形式化，包括编舞与编译后编舞之间的 bisimulation 结果，以及在重启情况下的回放等价性。
• 该架构通过使用与工作者通过 RPC 通信的 sidecar，能够与现有的多语言代码库集成，无需重写应用程序。

Figure 2 . A user checkout workflow implemented with orchestration (a) versus Accompanist (b).