Call-Level Revision Contracts for LLM-Authored Workflows

Chenyang Jiang, Benyang Pan, Puqu Wu

Durable execution engines replay a recorded history and do not compare activity payloads. When a model repairs a workflow that failed partway through, it must either pay again for calls that succeeded or accept a recorded result whose payload changed. We define a revision contract for workflows whose orchestration code is written by a model. Each capability call carries a structural identity built from its callsite, its fanout position, and its occurrence count, and the identity stays stable under rewrites that leave the call in place, so committed identities form a frozen prefix. The frozen unit is the call expression, and the surrounding code stays writable. A static gate rejects a rewrite that would change a committed call before a container starts. A runtime digest stops a changed payload at a committed identity, and an occurrence ledger names a repeated paid payload. Under three assumptions, a candidate the gate accepts replays every committed call it invokes, executes only new work, and reports the identities it skips. No local identity is both relocation-invariant and free of wrong reuse, so callsite identity turns a relocation into a pre-spend stop. On media workflows, 22…