Chapter 20

Separate the Agent Loop From Durable Orchestration

A long task survives a process crash only when state and effects are saved outside the worker's memory and the steps can be safely replayed. An agent SDK can manage the model loop, but a production workflow must additionally survive restart, network partition, delayed approval, and deployment: checkpoints fix the state after significant transitions, and the orchestration runtime restores ready work from durable records.

Intent: work item recorded
Execute: worker with lease
Record: artifact and receipt
Advance: status and next ready set
Resume: replay after crash

Temporal defines a Workflow Execution as durable, reliable, and scalable function execution and uses event history to recover after infrastructure failures. This doesn't mean Temporal will automatically fix the model's semantic error - it gives a reliable basis for waits, retries, and resume, while application-level policy stays yours. In the companion project the basis for replayable state is the same append-only event log.

TypeScript

import type { EventRecord, RunEvent } from "./types.js";

export class EventLog {
  readonly #records: EventRecord[] = [];
  readonly #clock: () => number;

  public constructor(clock: () => number = Date.now) {
    this.#clock = clock;
  }

  public append(event: RunEvent): EventRecord {
    const record: EventRecord = {
      sequence: this.#records.length + 1,
      timestamp: this.#clock(),
      event
    };
    this.#records.push(record);
    return record;
  }

  public records(): readonly EventRecord[] {
    return this.#records.map((record) => ({ ...record }));
  }
}

A checkpoint must contain the workflow and contract versions, work-item statuses and attempts, immutable references to inputs and outputs, the remaining budget, approvals and idempotency receipts, and, if needed for audit, the model, prompt, and tool versions.

Resume is not replay of model calls. Don't repeat an already-paid, accepted model output without need. Keep the validated artifact and continue from the nearest safe boundary.

Durability is provided. Next is security: each worker is given a minimal identity, not just a different prompt.

Separate the Agent Loop From Durable Orchestration

Links