面向安全关键部署流水线的审计优先回滚语义
Audit-First Rollback Semantics for Safety-Critical Deployment Pipelines
浏览论文内容
中文总结 AI 辅助
该研究针对安全关键部署流水线提出审计优先回滚语义，通过配对临时状态机保证故障停止崩溃下的审计/在线一致性，实验显示其一致性达100%且恢复延迟达标，性能优于故障开放变体。
中文摘要 AI 辅助
分布式部署运行时承载着经典容错框架未直接明确的一致性义务：组件被配置为运行的在线状态，以及记录其如何到达该状态的审计链，必须在每个终端配置下保持一致。现有工作主要关注部署时故障面的各个方面（金丝雀控制器、配置回滚、签名证明），仅粗略规定了仅发生故障停止崩溃时审计/在线一致性的跨领域问题。然而，一个关键系统问题仍未解决：即使在过渡过程中发生崩溃，部署运行时如何保证审计链能如实反映在线状态？我们提出审计优先回滚语义，这是一种容错机制，可在过渡阶段发生故障停止崩溃时，保证每个已提交终端的审计/在线一致性。该机制与临时状态机配对，临时状态机是其“活跃但尚未升级”状态带有显式回滚合约和有限截止时间的流水线。我们将两者实例化到一个运行时部署系统中，并针对同一流水线的故障开放变体，在跨越三类结构故障的12个故障注入点上运行可靠性评估。在1200次注入故障试验中，审计优先回滚实现了100%的审计/在线状态一致性（600/600，Wilson 95%置信区间[0.994,1.000]），每个单元的第95百分位恢复延迟低于500毫秒（12/12个单元满足服务水平目标要求）；而故障开放变体仅在33%的试验中保持一致性（200/600，Wilson 95%置信区间[0.297,0.372]）。我们进一步将该构造扩展为跨桥协调协议，并对故障停止桥集群提出了安全性论证，集群规模的实证评估留待后续工作开展。
英文摘要
Distributed deployment runtimes carry a coherence obligation that classical fault-tolerance frameworks do not name directly: the live state a component is configured to run and the audit chain that records how it got there must agree at every terminal configuration. Prior works mainly focus on individual aspects of the deploy-time fault surface (canary controllers, configuration rollback, signed attestations), leaving the cross-cutting question of audit/live coherence under fail-stop crash only loosely specified. Yet a key systems question remains unresolved: how can a deployment runtime guarantee that the audit chain answers truthfully about live state even when a transition crashes mid-flight? We present audit-first rollback semantics, a fault-tolerance mechanism that guarantees audit/live coherence at every committed terminal under fail-stop crashes during transition phases. The mechanism pairs with provisional state machines, pipelines whose "active but not yet promoted" states carry an explicit rollback contract and a bounded deadline. We instantiate both in a runtime deployment system and run a dependability evaluation against a fail-open variant of the same pipeline across twelve fault-injection points spanning three structural failure classes. Across 1,200 injected-failure trials, audit-first rollback achieves 100% audit/live-state coherence (600/600, Wilson 95% CI [0.994,1.000]) with per-cell p95 recovery latency below 500 ms (SLO PASS in 12/12 cells); the fail-open variant preserves coherence on only 33% of trials (200/600, Wilson 95% CI [0.297,0.372]). We further lift the construction to a cross-bridge coordination protocol with a safety argument for fleets of fail-stop bridges, leaving fleet-scale empirical evaluation to follow-on work.
发表机构
- School of Software, Harbin Institute of Technology（哈尔滨工业大学软件学院）
- School of Computer Science and Technology, Harbin Institute of Technology（哈尔滨工业大学计算机科学与技术学院）
- School of Future Science and Engineering, Soochow University（苏州大学未来科学与工程学院）
机构由 AI 辅助整理，请以论文原文为准。
