Execution

Execution owns how bounded work runs: tasks, threads, scheduling, cancellation, deadlines, signals, queues, backpressure, supervision, and resource budgets. It does not own application operations, workflow meaning, or provider selection.

Structured concurrency is the default

Every task belongs to a scope with an owner, children, completion policy, and cleanup path. A parent cannot report completion while silently abandoning child work. Detached work requires a durable owner such as a job, workflow, service, or explicitly retained host process.

Cancellation is a request propagated through the scope. Each boundary declares whether it can stop before dispatch, interrupt execution, drain, or merely stop waiting. Dropping a handle is never interpreted as rollback.

Time is typed

Deadlines, timers, leases, retry schedules, wall timestamps, and monotonic durations use their applicable time authorities. Distributed wall clocks carry uncertainty. Leases and fences do not rely on untrusted wall time alone.

Simulation replaces time and entropy with exact providers. Simulated results remain visibly non-production evidence.

Simulation and deterministic execution

A deterministic runtime replaces clocks, entropy, I/O, scheduling, and external effects with controlled providers, so tests choose schedules and fault scripts and record their choices for replay. Simulation may explore bounded interleavings, but a simulated result is visibly non-production evidence: it never becomes a grant, artifact, or deployment claim.

The same contract supports ordinary and simulated execution. Choosing a deterministic provider does not weaken the cancellation, deadline, budget, or effect rules above; it makes their ordering reproducible. Measured performance claims remain separate and belong to benchmark and performance evidence.

Capacity is finite

Tasks declare or acquire CPU, memory, thread, blocking, accelerator, I/O, queue, and concurrency budgets. Schedulers enforce priorities and fairness within their authority domain.

Backpressure begins at bounded queues and propagates through streams and calls. When propagation is impossible, the contract chooses rejection, shedding, sampling, spill, or bounded loss. Unbounded buffering is never a hidden default.

Failure has a parent

Panic, process exit, lost worker, deadline, cancellation, resource exhaustion, and provider defects have distinct dispositions. Supervision policy chooses restart, escalate, degrade, quarantine, or terminate, with attempt budgets and effect safety checked before repetition.

A runtime crash does not erase effect intent. Durable operations and workflows resume through their owning journals and histories.

Runtimes are replaceable

A single-thread executor, work-stealing runtime, real-time loop, Wasm host, language runtime, OS process, batch scheduler, or distributed worker pool may realize selected execution contracts. Each profile states scheduling, cancellation, isolation, resource, timing, failure, and observation guarantees.

Portable computation is a separate contract. Code is not considered portable merely because a scheduler can send bytes to another machine.

Relationship to resources and components

Execution schedules bounded work; it does not own what the work means or which resource it borrowed. A task receives its capabilities and budgets from the owning component and borrows storage, handles, or accelerator capacity through resource contracts that own acquisition, transfer, release, and recovery. Dropping a task handle is not proof that a borrowed resource or dispatched effect stopped.

This separation is why an executor can be replaced without revising application meaning, and why a resource can be reattached after a crash through its durable owner. Simulation and fault campaigns that prove these claims are authored as root-scoped tests and fixtures.

Example

Illustrative structured concurrency bounds children and waits for completion:

Rust

let mut scope = ctx.execution().scope();
scope.spawn_bounded(validate(batch)).await?;
let results = scope.join_all().await?;

Executable evidence

The Execution atoms own the current checks for cancellation, deadlines, channels, timers, signals, and tasks, and the Resources atoms own the lifecycle and tree checks. The resources and execution recipe is illustrative end-product syntax over those contracts:

Console

cargo test -p one-runtime-cancel -p one-runtime-deadline -p one-runtime-channel
cargo test -p one-lifecycle -p one-resource-tree

These checks exercise the atoms named, not the composed ImportOrders scenario shown above.

Follow Manage resources and execution.

Canonical owner: Execution.