remora/docs/protocol/RemoraTargetFault.cfg

SPECIFICATION SafetySpec

CHECK_DEADLOCK TRUE

\* Worker can reach coordination and durable authority while target is cut.
\* Single worker: CrashWorker disabled (OtherCapacity); partitions only.
CONSTANTS
    Jobs = {j1}
    Workers = {w1}
    InitialWorkers = {w1}
    NoJob = NoJob
    NoWorker = NoWorker
    MaxAttempts = 2
    MaxProgress = 1
    LeaseLimit = 1
    LocalLimit = 1
    GlobalLimit = 1
    FaultsEnabled = TRUE
    FaultServices = {"Target"}
    MaxCoordLosses = 0
    MaxPartitions = 2

INVARIANTS
    TypeOK
    StateConsistency
    AllocatedTokensUsed
    LiveProgressAligned
    AtMostOneLiveLeasePerJob
    AuthorityWellFormed
    CommittedResultConsistent
    CancellationSafety
    PermitSafety
    ResumeValidity
    StagingOwnership

PROPERTIES
    TerminalStateIsImmutable
    FencingTokensMonotonic
    CommitIsFencedCAS
Add initial draft of Remora model 2026-07-10 11:39:49 +09:00			`SPECIFICATION SafetySpec`

Strengthen JobProtocol model after independent review. Replace tautological invariants with non-trivial ones, allow multi-shot coordination loss and re-partition, fix reap/progress lifecycle, enable deadlock checking via Done, and add stress and multi-shot TLC configs. 2026-07-10 12:43:32 +09:00			`CHECK_DEADLOCK TRUE`
Add initial draft of Remora model 2026-07-10 11:39:49 +09:00
			`\* Worker can reach coordination and durable authority while target is cut.`
Strengthen JobProtocol model after independent review. Replace tautological invariants with non-trivial ones, allow multi-shot coordination loss and re-partition, fix reap/progress lifecycle, enable deadlock checking via Done, and add stress and multi-shot TLC configs. 2026-07-10 12:43:32 +09:00			`\* Single worker: CrashWorker disabled (OtherCapacity); partitions only.`
Add initial draft of Remora model 2026-07-10 11:39:49 +09:00			`CONSTANTS`
			`Jobs = {j1}`
			`Workers = {w1}`
			`InitialWorkers = {w1}`
			`NoJob = NoJob`
			`NoWorker = NoWorker`
			`MaxAttempts = 2`
			`MaxProgress = 1`
			`LeaseLimit = 1`
			`LocalLimit = 1`
			`GlobalLimit = 1`
			`FaultsEnabled = TRUE`
			`FaultServices = {"Target"}`
Strengthen JobProtocol model after independent review. Replace tautological invariants with non-trivial ones, allow multi-shot coordination loss and re-partition, fix reap/progress lifecycle, enable deadlock checking via Done, and add stress and multi-shot TLC configs. 2026-07-10 12:43:32 +09:00			`MaxCoordLosses = 0`
			`MaxPartitions = 2`
Add initial draft of Remora model 2026-07-10 11:39:49 +09:00
			`INVARIANTS`
			`TypeOK`
			`StateConsistency`
Strengthen JobProtocol model after independent review. Replace tautological invariants with non-trivial ones, allow multi-shot coordination loss and re-partition, fix reap/progress lifecycle, enable deadlock checking via Done, and add stress and multi-shot TLC configs. 2026-07-10 12:43:32 +09:00			`AllocatedTokensUsed`
			`LiveProgressAligned`
			`AtMostOneLiveLeasePerJob`
			`AuthorityWellFormed`
Add initial draft of Remora model 2026-07-10 11:39:49 +09:00			`CommittedResultConsistent`
			`CancellationSafety`
			`PermitSafety`
			`ResumeValidity`
Strengthen JobProtocol model after independent review. Replace tautological invariants with non-trivial ones, allow multi-shot coordination loss and re-partition, fix reap/progress lifecycle, enable deadlock checking via Done, and add stress and multi-shot TLC configs. 2026-07-10 12:43:32 +09:00			`StagingOwnership`
Add initial draft of Remora model 2026-07-10 11:39:49 +09:00
			`PROPERTIES`
			`TerminalStateIsImmutable`
			`FencingTokensMonotonic`
			`CommitIsFencedCAS`