Cold open · Platformatic · Vancouver · October 2026

agents are workflows

Determinism, journals, and state without a landlord.

Luca Maraschi · CEO, Platformatic→ next · ← back · f fullscreen · p presenter

Cold open · Who is talking

Luca Maraschi, Platformatic

Me

Co-founder and CEO of Platformatic. Three companies founded and exited before this one.

Twenty years running engineering, the Canadian chapter at mobileLIVE and Telus Digital. Based in Vancouver.

I work on the runtime layer where durable execution, agents and self-hosted infrastructure meet.

Platformatic

Node.js infrastructure, co-founded with Matteo Collina.

Watt: an application server that runs Node.js services as worker threads with in-memory routing.

ICC: the control plane that runs them on Kubernetes: deployments, scaling, upgrade safety.

Core maintainers of Fastify, Undici and Pino, the libraries under both products.

Papers, with Matteo Collina

2309.06238A risk index for breaking changes across a microservice graph, computed from OpenTelemetry traces (2023)
2604.19705Predictive autoscaling for Node.js on Kubernetes
2607.13617A telemetry-driven model for quantifying upgrade risk in durable workflow execution (WUR)
2609.17645State Without a Landlord: peer-to-peer replication of durable workflow state. The last section of this talk.

Cold open · Minimum viable product

A production agent is a long-running program that calls a nondeterministic function in a loop

Cold open · How it usually gets built

Ad hoc durability

CheckpointsSerialize "where we are" into a database at hand-picked points. Every point is a guess.
Retry wrappersDecorators around tool calls. Idempotency is the tool author's problem.
State in a tableA status column that the code and the table disagree about after a crash.
Resume logicA second code path that nobody tests, executed only on the worst day.

Each piece is reasonable. Together they have no invariant.

There is no statement of the form "after any crash, the system is in state S" that you can check. You cannot replay a checkpoint. You cannot prove a retry was safe. You cannot tell a truncated history from a complete one.

Season 01

S01 · E01

Middle-Out

One ordinary async function. A compiler splits it from the middle out into a deterministic orchestrator and a set of steps, and an append-only journal makes the whole thing recoverable.

S01 · Middle-Out · Enter Workflow SDK

Workflow SDK: durable execution as a library, not a platform

What it is

Vercel's open-source durable execution SDK for TypeScript. github.com/vercel/workflow

Two directives, "use workflow" and "use step", on ordinary async functions.

Next.js, Express, Fastify, Hono, Nitro, SvelteKit, Astro, Nest. A Python SDK in beta.

Where it is

GA in April 2026 with 200K+ weekly downloads and 75+ beta releases behind it.

v5 stable in October: workflow@5.2.3 on 20 Oct, up to 5x faster than v4 with no API change.

Same family as AI SDK and Chat SDK.

The World

The runtime talks to one interface for storage, queue and streams.

First-party: Vercel, Postgres, Local. Community: Rivet, browser, MongoDB, Redis, Turso, and ours.

Even Vercel's own backend is one World among several.

Where we stand

We do not own the SDK. We run it self-hosted: PlatformaticWorld on Watt and Kubernetes, ICC for deployment safety.

And we contribute upstream: build hooks (#3163), diagnostics_channel tracing (#3463).

Every slide from here is about this runtime.

S01 · Middle-Out · The claim

A workflow is an ordinary async function. The compiler does the rest.

export async function triageAgent(issue) {
  "use workflow";                       // orchestrator
  let plan = await callModel({ issue });
  while (!plan.done) {
    const out = await runTool(plan.tool);
    plan = await callModel({ issue, out });
  }
  const hook = createHook({ token: issue.id });
  await notifyReviewer(hook.token);    // suspends
  for await (const d of hook) {
    return d.approved ? await apply(plan) : plan;
  }
}

async function callModel(input) {
  "use step";                           // side effects
  return llm.generate(input);
}

"use workflow"The orchestrator. Plain control flow: loops, try/catch, Promise.all. No I/O.
"use step"The only place a side effect may happen. LLM calls, tools, writes.
hooks, sleepSuspension points. The run becomes a journal plus a queue message.
No framework objectNo ctx.step(...), no DSL. The language is the workflow engine.

S01 · Middle-Out · Mechanism 1 of 3

The compiler splits one function into an orchestrator and addressable steps

S01 · Middle-Out · Mechanism 2 of 3

The journal is the run. Recovery is replay, not reconstruction.

Go slowly. Say: "Invocation one loads the log, one event, replays the orchestrator, and reaches the first await with no recorded answer."
Click 1: "It writes the intent, dispatches the step through the queue, and exits. It holds nothing."
Click 2: "The step runs and writes its result."
Click 3: "Next invocation, same dance, next step."
Click 4: "The process dies inside the tool body."
Click 5: "The queue redelivers. step_started is refused only on a terminal run; this run is live, so the step reruns."
Click 6: "Same step id, same input. The result lands at the next free position."
Click 7: "A fresh invocation reads events one to seven. Every await resolves from the log. The code walks past runTool as if nothing happened. Nothing was reconstructed. The run was recomputed from a prefix of its own log." Two and a half minutes.

S01 · Middle-Out · What the one choice buys

Five properties agents need, for free

Suspension is freeA run waiting three days is a journal row plus a delayed queue message. No process, no connection, no spinner.
Recovery is replayAny invocation can be killed at any instant. The next one recomputes from the log prefix. There is no resume code path.
Retry at the step boundaryIdempotency is a property of the step id and input, not of the tool author's discipline.
Version skew is explicitA run is pinned to the deployment that created it. Deliveries that reach the wrong deployment are re-routed, then fail with DEPLOYMENT_MISMATCH.
The journal is the traceSpans are projected from events, deterministically, instead of sampled from a process that may not survive.

S01 · Middle-Out · Suspension, measured in compute

Waiting three days costs zero compute

S01 · Middle-Out · Mechanism 3 of 3

Determinism is enforced, not requested

Not available inside the orchestrator

Time, randomnessDate.now, Math.random resolve from the journal. Atomics.waitAsync is not exposed: wall-clock timing cannot replay.
GC observationWeakRef, FinalizationRegistry and async WebAssembly compilation are removed from the sandbox.
Cryptocrypto.subtle.digest computes synchronously via node:crypto: identical bytes, deterministic timing under replay.

How

node:vm sandboxHost intrinsics captured at boot; serializing a workflow value never executes workflow code.
QuickJS in WASMOpt-in engine (WORKFLOW_VM=quickjs): same full replay, runs where node:vm does not, and enables VM memory snapshots so a 25K-event run stops replaying from zero.
Bounded replayServer-supplied per-run event limit, default 25K. Snapshotted QuickJS runs are exempt.

S01 · Middle-Out · Runtime-to-infrastructure separation

The runtime talks to exactly one interface: the World

S01 · Middle-Out · Self-hosted

The same runtime on Watt and Kubernetes, with ICC as the control plane

S01 · Middle-Out · Cross-deployment steps

A step can execute as an isolated workflow in another deployment and still belong to one run

S01 · Middle-Out · Observability

The journal is the trace

Season 02

S02 · E01

Tabs versus Spaces

Four systems from three teams landed on the same invariant in 2026: commit the intent before the effect, recover from what was committed. Same invariant, four contracts. Then, on 1 October, one of them changed the equation for the other two.

Workflow SDK · Cloudflare Workflows · Cloudflare fibers · Pi Durable

S02 · Tabs versus Spaces · Cloudflare Agents SDK, Durable Objects

Fibers: a durable function invocation registered before it runs

S02 · Tabs versus Spaces · Cloudflare Workflows v2, 15 Apr 2026

Cloudflare Workflows: memoized steps, one Engine per instance

export class Triage extends WorkflowEntrypoint {
  async run(event, step) {
    const plan = await step.do("plan", () => model(event));
    const out = await step.do("tool", () => tool(plan));
    await step.waitForEvent("approval", { timeout: "7d" });
    return step.do("deploy", () => deploy(out));
  }
}

S02 · Tabs versus Spaces · Earendil Pi Durable · Pi 1.0, 1 Oct 2026

Every tool call is a task whose intent is committed before it executes

Say: "Pi Durable shipped with Pi 1.0 on 1 October. A harness opens over a storage backend: memory, SQLite or JSONL, one process owning it."
Click 1: "A conversation is a transcript. Everything the harness runs is a task, and each task phase stores a checkpoint before it moves on. The tool's intent is committed before the tool runs."
Click 2: "The process dies."
Click 3: "A new process opens the same storage, finds the unfinished tasks and continues each from its checkpoint. A model request that was cut off is simply re-sent."
Click 4: "The rerun decision is per tool. replay: safe reruns. No flag: the model is told the call was interrupted and decides. Deploy is the example, and it is the right example."
Click 5: "Memos make hooks idempotent, first write wins; requestId makes a submission exactly-once. About fifteen thousand lines. Note what is absent: no determinism requirement on the loop at all." Ninety seconds.

S02 · Tabs versus Spaces · Three weeks in October

1 October changed the equation: the harness became a third party

Before October: each platform owned its harness (Project Think, eve, fx) and the durability model under it.
After October: the harness is a third party. The platform competes on the storage, queue and compute contract underneath it.

Durability stopped being a feature of the harness and became the product of the platform.

The slide this season was built for. Say: "Dates, not vibes. 1 October: Pi Durable ships, with a storage interface small enough, in Earendil's words, to run inside a Cloudflare Durable Object."
Click 1: "One day later, Cloudflare ships PiHarness: Pi's own Harness hosted inside a Durable Object. Built with Earendil, described as the first step toward first-class support for third-party harnesses."
Click 2: "Eleven days after that, the World contract grows route-agnostic queue delivery, PR 4835. The PR names its reason: a durable agent harness that keeps its own runs in a World."
Click 3: "On the 19th Vercel ships durable-harness. Pi Durable running on a World is the recommended path, and Pi's replay safe-or-never contract is applied to Claude Code, Codex and OpenCode. On the 22nd Cloudflare tracks Pi 1.4."
Click 4: "Before October, each platform owned its harness and the durability model under it. After October the harness is a third party and the platform competes on the storage, queue and compute contract underneath it."
Click 5: "Durability stopped being a feature of the harness and became the product of the platform." Pause. Add nothing. Two minutes.

S02 · Tabs versus Spaces · Side by side

Same invariant, four different contracts

	Workflow SDK	Cloudflare Workflows	Cloudflare fibers	Pi Durable
unit of durability	event in an append-only, slot-numbered log	step.do return, keyed by step name, in the Engine DO	fiber row + stash snapshot in DO SQLite	task checkpoint + committed intent
recovery	deterministic replay of the log prefix	run() re-executes; done steps return cached values	snapshot to onFiberRecovered; harness decides	resume each task from its last checkpoint
effect boundary	"use step", compiler-enforced	step.do; code outside may run twice	wherever you call stash()	tool, with a replay flag
idempotency	step id + input; dedup on (runId, resumeId)	step name as cache key; steps "should ideally be idempotent"	yours, between stashes	replay:"safe", memos, requestId
determinism	enforced by the sandbox	required by the rules page	not required	not required; model calls re-sent
where it runs	any World, any host	Cloudflare	Cloudflare	any JS runtime; one process owns storage
who owns the journal	the World	the Engine Durable Object	the Durable Object	the storage backend

Do not read cells. Per click, the one thing the row proves.
Click 1 (recovery): "Only one of the four makes recovery a pure function of persisted state. Cloudflare Workflows is closest. The other two carry a then the harness decides branch, which is slide 4's untested code path with better tooling."
Click 2: "One compiler-enforced, one by convention, one wherever you call stash, one per tool."
Click 3: "Who carries idempotency: the runtime, the step name, you, or a flag."
Click 4: "Enforced, required, not required, not required. That is the real axis of this table."
Click 5: one word each.
Click 6: "The World, a Durable Object, a Durable Object, a storage backend. Every one of them is a landlord. Season three." The opinion, once: "For agents that negotiate, deploy, or spend money, I want the pure function. The others pay less in determinism discipline and that is a real trade." Ninety seconds.

Season 03

S03 · E01

The New Internet

The World became the spec. In 4.x it was an adapter the SDK happened to use. In 5, the SDK is one client of a published protocol, and it checks the version of the thing it is talking to.

workflow@5.2.3 · @workflow/world@5.0.5 · world-vercel@5.2.3 · world-postgres@5.0.5 · world-local@5.1.2 · released 20 Oct 2026

S03 · The New Internet · What changed in the contract

Spec versions, slot-numbered events, a runtime that checks

Say: "In 4.x an event id was any ULID, and the runtime demanded exact version equality with its World."
Click 1: "Spec 6 is slot identity. An event id is its position, dense from one, allocated in the same operation that commits. A writer with a stale count is not rejected; the World commits at the next free slot and returns the events it skipped, so a parallel fan-out never serializes."
Click 2: "Spec 7, the sealed log: a World that must pre-assign positions may, if it seals every abandoned hole with a noop."
Click 3: "Spec 8 is what mintedSpecVersion() stamps today: hook token takeover and the in-band writer fence."
Click 4: "workflow 5.2 accepts a World declaring 6 through 8 and refuses anything else at startup. A run keeps the version it was created under for its whole life."
Click 5: "Density is the property. A reader can tell a truncated log from a complete one by its length alone. That was the thing slide 4 could not do. The contract is about what a reader may conclude." Two minutes.

S03 · The New Internet · The inversion

Workflow SDK is now a client of the World

Say: "This was the picture. The SDK in the middle, storage as its adapter."
Click 1: the old picture dissolves. Say nothing for a beat.
Click 2: "The SDK is one client. It owns one queue prefix and one route."
Click 3: "The Python runtime is a second client. Since 0.9.0 in August it reads and writes the same files and queue."
Click 4: "A durable agent harness is a third: its own runs, its own prefix, routed by registerRoute or registerHandler. That is slide 21, hosted on this contract."
Click 5: "Dashboards and admin tools read the World directly. invoke is request-response into a live run, one runner per run id."
Click 6: "And the implementations, with a conformance suite any of them can run."
Click 7: "A protocol with a version, a conformance suite and more than one client. The SDK happens to be the first of them." Ninety seconds.

S03 · The New Internet · The uncomfortable question

If the journal is the agent, who owns the journal?

Say: "If the journal is the agent, who owns the journal? Today the World does. Durability, timeouts and continuation after a deploy are the landlord's word. Every system in the table has a landlord."
Click 1: "The paper pulls the landlord out. The log is replicated among the parties to the workflow and authenticated."
Click 2: "Executors take turns as single-writer epochs."
Click 3: "Succession happens only when a quorum signs the closure of the previous epoch. Nobody hands off on their own word."
Click 4: "Durability and timeouts are asserted by certificates anyone can verify, not by a scheduler. Payloads move on a content-addressed plane no party controls."
Click 5: "A signature proves who wrote what, in what order. It proves nothing about whether the recorded effect happened. That gap is the whole threat model for agents that negotiate across companies, outlive their vendor, or cannot be trusted. The adversarial experiments are written up. Come break it." Two and a half minutes.

Outro · Take with you

Build the agent as a workflow. Treat the World as the contract.

The invariantSide effects only in steps, results only in an append-only log, recovery as a pure function of that log.
The convergenceCloudflare Workflows, fibers and Pi Durable commit intent before effect too. The difference is whether recovery replays or decides, and whether determinism is enforced or requested.
The inversionThree weeks after Pi Durable, both platforms host it. The World is a versioned protocol with a conformance suite; the SDK is one client. Build against the spec.
The open problemA run with no host. Signatures prove order, not effects. Come break it.

useworkflow.dev · workflow-sdk.dev/worlds · platformatic.dev arXiv 2609.17645 (State Without a Landlord) · arXiv 2607.13617 (upgrade risk in durable execution) Luca Maraschi · @lucamaraschi · luca@platformatic.dev

End credits · Platformatic · Vancouver · October 2026

thank you.

Making the world a better place through append-only, slot-numbered event logs.

Luca Maraschi · @lucamaraschi · luca@platformatic.dev platformatic.dev · useworkflow.dev · arXiv 2609.17645