Counting visitors…
RUNIFOLD
中文GitHub
Menu
QuickstartCookbookPlatformProvidersOperations
Browse all docs
Start · 9Find your path through RunifoldLearn Runifold in 45 minutesUnderstand the complete Runifold platformYour first trustworthy runChoose the right execution APIChoose crates and Cargo featuresBuild common Runifold applicationsRunifold frequently asked questionsTroubleshoot Runifold applications
Execution kernel · 7Understand RunContextCoordinate external effects safelyBound work with budgets and cancellationHandle errors and retries safelyEvents, journals, and execution evidenceDesign capability-safe executionRecover safely from checkpoints
Models & providers · 7Route across models without duplicate outputChoose and configure a providerUse the provider-neutral model protocolBuild on the Provider Runtime contractUse OpenAI control-plane and Realtime APIsTest and benchmark provider adaptersSet up OpenAI, Anthropic, Gemini, and Ollama
Agents · 7Build and configure an AgentGive an Agent typed toolsAdd conversations and semantic memoryDelegate to child Agents safelyReturn structured Rust valuesStream without losing semanticsGround an Agent with retrieval
Durable workflows · 7Compose deterministic workflowsMake workflows durableOperate durable workflow workersCoordinate timers, signals, and durable waitsRun multi-tenant workflow infrastructureRun parallel branches and safe racesVersion and evolve durable workflows
Integrations · 7Connect through MCPChoose stores and persistence boundariesExpose durable work through MCP TasksBuild and evaluate retrieval pipelinesUse MCP Resources, Prompts, and SamplingCache MCP responses without crossing authorityDeploy Runifold in a Rust web service
Quality & operations · 10Test without the networkEvaluate quality and prevent regressionsObserve the complete run treeRun safely in browsers and at the edgeRead reliability claims preciselyRun reproducible evaluations in CIOperate Runifold with SLOsGovern Task retention and deletionArchive audit evidence to S3-compatible WORM storageManage compatibility and trusted releases
Docs/Quality and operations
NEW TO RUNIFOLD?Build the complete mental model in 45 minutes
Quality and operations

Govern Task retention and deletion

Supervise fenced cleanup, preserve tombstones, apply legal holds, require independent approval, and retain purge evidence.

Practical guide·12 min

Separate lifecycles

MCP handle TTL, Workflow execution deadline, terminal Task retention, detailed tombstone retention, legal hold, and archive retention are independent lifecycles. Conflating them can delete active work or preserve personal data forever.

Execution Workers do not delete history. A separate control plane owns retention and audit destruction.

Cleanup supervision

The supervisor discovers tenants with eligible terminal Tasks using bounded keyset pages, assigns deterministic process shards, claims one fenced tenant cleanup lease, heartbeats it, and deletes bounded batches. Lease loss stops that tenant immediately.

Atomic deletion inserts an immutable tombstone and removes dependent checkpoint, Signal, and leftover reservation state. Active, leased, queued, and waiting Tasks are never eligible.

A legal hold is tenant- and checkpoint-scoped, records principal, reason, and database time, and remains auditable after release. Export confirmation advances a monotonic cursor only after an archive returns a durable receipt.

Preparation excludes active holds and only includes tombstones at or below the confirmed export watermark. Execution rechecks holds atomically with deletion.

Four-eyes purge

One authenticated principal prepares an exact bounded member set. A different principal must claim and approve it before the deadline. A current fenced owner executes. The preparer cannot approve; a stale reviewer or executor cannot decide after takeover.

Authorization permissions remain narrow for hold, release, export, prepare, approve, execute, and evidence read. Policy outage and denial both fail closed.

Durable evidence

Successful purge atomically deletes detailed tombstones and inserts immutable aggregate evidence with tenant, principals, count, cursor range, export watermark, fingerprint, and database execution time. Retry returns the same evidence.

Monitor fixed operation and outcome dimensions. Never place tenant, principal, checkpoint, purge, lease, or receipt identity in metric labels.

Production rollout

Treat governance as a separate scheduled worker. Start with purge disabled, verify discovery and lease metrics, then enable one tenant and one small batch. The control loop should always follow the same order:

discover eligible tenants -> claim fenced lease -> heartbeat
-> export tombstones -> confirm archive receipt -> prepare purge
-> second principal approves -> current lease owner executes

Before widening the rollout, simulate lease loss between every two stages, repeat the same export and purge identifiers, and verify that retries return the original receipt or evidence instead of creating a second decision. Alert on export-watermark lag, expired approvals, repeated lease loss, and policy unavailability. If any of these occur, stop deletion while leaving execution workers running.