Observable, idempotent, failure-safe workflows
A safe workflow makes commitment atomic and repetition uneventful.
A churn notebook cannot be reproduced by the teammate expected to ship it.
This chapter moves from emit structured milestones to make retry a test. We will make the idea concrete in a small code example before placing it back inside a production system with a declared latency, cost, and operator-capacity budget.
Run the same job twice and assert one committed artifact, identical bytes, and no duplicated downstream side effect.
Verify the behavior illustrated in atomic_publish.py, then measure decision utility, slice reliability, and system latency.
A mutable data/latest path and unpinned dependencies create a different model from the same command. An unsafe release must degrade to a named baseline or the last known-good version.
Build the idea one layer at a time.
Production workflows are retried precisely when the previous attempt is least trustworthy. Their design must make a second attempt boring.
Idempotency means repeating an operation converges on the same committed state. Content-addressed outputs are a strong foundation: identical bytes map to one target, while conflicting bytes under the same identity expose a broken assumption.
Failure safety comes from separating construction from commitment. Write and validate a temporary artifact first, then rename it atomically; observers see either the old complete state or the new complete state, never half a model.
- schema contracts
- golden inference
- idempotency
Follow the reasoning before touching the code.
- 01
Emit structured milestones
Log run ID, stage, input digest, duration, and outcome so an operator can locate the failed boundary.
- 02
Stage before commit
Write to a temporary path, verify checksum and golden inference, then atomically replace the final path.
- 03
Make retry a test
Run the same job twice and assert one committed artifact, identical bytes, and no duplicated downstream side effect.
from hashlib import sha256
from pathlib import Path
payload = b"model-version-3"
digest = sha256(payload).hexdigest()[:12]
output = Path("artifacts")
output.mkdir(exist_ok=True)
target = output / f"{digest}.bin"
if target.exists():
assert target.read_bytes() == payload
else:
staged = output / f".{digest}.tmp"
staged.write_bytes(payload)
assert sha256(staged.read_bytes()).hexdigest().startswith(digest)
staged.replace(target)
print("committed", target)Publish immutable bytes safely across retries.
What to notice
- A retry finds the target and verifies content rather than appending or overwriting blindly.
- Path.replace is the commit point, so readers never need to interpret a partially written target.
YOUR TURN Pause and predict before revealing the answer.
Change payload while forcing the old digest string. Why should the workflow fail instead of replacing the target?
Need a hint?
An identity collision means the target no longer describes its content.
Check your reasoning
It should reject the mismatch because silently replacing content would make previous manifests and consumers point to different bytes.
Lessons 1, 2, 3, 4 in this course.
Connect the chapter to the course’s quantitative spine.
A safe workflow makes commitment atomic and repetition uneventful. The content-addressed run identity below is the shared course-level lens that helps quantify the surrounding system. Name each symbol, check its units or shape, and use only values that were available at the production cutoff.
Content-addressed run identity
| Symbol | Meaning / shape / unit |
|---|---|
code | source revision digest |
data | immutable dataset digest |
image | OCI image digest |
seed | declared random seed |
Open derivation and numerical substitution
Start from the production quantity being optimized, substitute the observed values with their declared units, then isolate the model-controlled term. Preserve shape annotations at each step so broadcasting or aggregation cannot silently change the result.
- Write the named inputs: code, data, image, seed.
- Substitute one small, hand-checkable batch before vectorizing.
- Calculate an independent reference value and compare within a declared tolerance.
# equation → code contract
inputs = validate_shapes_and_units(batch)
value = compute_c01(inputs)
assert is_finite(value)Change one assumption and make the tradeoff visible.
Use the worked chapter as your prediction, then change one input in the lab and explain why the output moves. The lab runs predefined TypeScript and never executes learner code, so the focus stays on the concept rather than setup.
Reproducibility fault injector
Change how many declared inputs remain mutable and observe replay parity.
Assumption: Each mutable input independently creates a 14-point replay risk.
Open nonvisual data table
| Item | Computed state | Interpretation |
|---|---|---|
| input 1 | mutable | replay risk |
| input 2 | mutable | replay risk |
| input 3 | content-addressed | verified |
| input 4 | content-addressed | verified |
| input 5 | content-addressed | verified |
Trace the complete operating path.
Carry the chapter’s central idea into the system: A safe workflow makes commitment atomic and repetition uneventful. The path below shows where that reasoning needs an artifact, a test, an owner, or a fallback.
- 01
Turn “Emit structured milestones” into a written invariant and a failing test.
- 02
Promote atomic_publish.py from illustration to a versioned implementation with representative fixtures.
- 03
Use “Make retry a test” as the release checkpoint: Run the same job twice and assert one committed artifact, identical bytes, and no duplicated downstream side effect.
- 04
Serve or materialize behind explicit a declared latency, cost, and operator-capacity budget.
- 05
Join telemetry to mature outcomes and retain a rollback path.
Observability
Join service health, input quality, prediction distributions, slice behavior, and mature outcomes by exact version.
Cost
Measure storage, preprocessing, compute, queueing, and human review under a representative arrival pattern.
Failure modes
A mutable data/latest path and unpinned dependencies create a different model from the same command. Add a detector, owner, mitigation, and stop condition for this class of failure.
Alternatives
Compare a rule, a simpler statistical baseline, and a different system boundary before adding model complexity.
Explain the contract, not just the vocabulary.
Reproducible baseline package
Design a Docker-only workflow that validates data, trains, evaluates, serializes, performs golden inference, and emits complete lineage.
- Run manifest and data contract
- Raw-input golden parity test
- Failure and retry runbook
- Model card with residual nondeterminism
Read primary material with a purpose.
Return to the opening failure.
Reject promotion when any artifact lacks lineage, golden raw-request parity, or a failure-safe recovery path.
For this lesson, the release evidence is the worked code example, a hand-checked formal result, deterministic simulation output, a ≥80% checkpoint, the production rubric, and a named fallback. The course resolves when the system can produce a seeded, tested, packaged, versioned training workflow with a model card.