Summary

  • In Argus, a guardian enclosed processes, objects and recovery responsibility, while an atomic action made participating recoverable object changes serializable and all-or-nothing.
  • Commit did not prove that an external device, human workflow or unmanaged I/O completed. Nor did it identify the human behind a handler call or certify a wider business invariant.

A green commit light and a silent machine

Imagine a handler that updates a durable control object and then asks equipment outside the Argus world to move. The topaction reaches a clean decision. Every participating guardian agrees. Stable object versions are recorded. The reply returns.

The equipment remains still.

Nothing in that scene contradicts the transaction result. Argus can make a strong claim about the recoverable objects enlisted in its action and no claim at all about an unmanaged device beyond them. That distinction is easy to lose because “commit” sounds final. In Barbara Liskov's Argus work, finality was not a mood or an enterprise-wide promise. It was a carefully delimited property of a language and runtime.

The 1983 paper Guardians and Actions, written by Liskov and Robert Scheifler, joined two abstractions. A guardian gathered the resources and processes belonging to a distributed program at a node. An action gathered the operations that should appear serial and should either take effect together or leave the relevant recoverable state as it was. The pairing moved failure handling out of scattered application conventions and into a system programmers could reason about.

It also drew an evidence boundary. A commit was authoritative inside the participant set. Beyond that set, another receipt was needed.

The guardian owned a recovery domain, not the whole world

A guardian resembled a module with a life beyond one process. It could hold objects, run processes and export handlers that other guardians called. Its recoverable state could survive a node failure; its volatile state would be reconstructed. This made the guardian a natural place to say who was responsible for restoring which data.

The word “guardian” can tempt a modern reader into imagining a universal security monitor. That is too broad. The abstraction encapsulated a program's resources and recovery work. It did not automatically wrap every file, device, person or service touched by the surrounding organization.

The distinction appears in Argus's own storage model. Stable variables were roots from which resilient objects could be recovered. Before a topaction committed, the new state of modified stable objects had to reach stable storage. Volatile variables, by contrast, were initialized again after recovery. Merely making a stable variable point at something non-resilient did not turn that referent into durable transactional state. The object type and recovery implementation still mattered.

That is a more exact claim than “Argus made distributed programs reliable.” It made a defined class of state recoverable under defined failure assumptions. The definition did the real work.

A handler call grew an action tree

Remote work in Argus was not an invisible detour from the transaction. Calling a handler in another guardian created structure in the action tree. The caller had a call action; the target ran an activation action. Arguments and results crossed the guardian boundary by value, and the return path participated in deciding how those subactions ended.

An ordinary return or signal normally committed the handler activation. An abort return or abort signal ended it by aborting. This detail matters because an exception is not automatically a synonym for transaction failure. If a program regarded an exception as a reason not to commit the enclosing work, it needed to catch and handle that condition at the appropriate action boundary.

Subactions gave programmers containment. One could abort without necessarily destroying its parent. When a subaction committed, however, its tentative versions and locks moved upward. Its work remained conditional on the parent and ultimately on the topaction. “Subaction committed” therefore did not mean “permanent independently of the caller.” It meant that this branch had successfully joined its result to the parent action.

The topaction was the root. At its commit, the system coordinated the participating guardians, using two-phase commit where the distributed decision required it, and recorded the new versions of stable objects modified by the action and its committed descendants. If the topaction aborted, the transactionally managed state returned to its previous version.

This hierarchy is the first guard against inflated evidence. A successful handler activation is not yet a topaction commit. A committed subaction is not independently durable. A topaction commit is not proof about a non-participant.

Orphans showed why a reply was not the whole story

Distributed calls fail ambiguously. A node can disappear while work elsewhere is still running. A caller can lose the return path without knowing whether the remote activation stopped. Argus called an action whose ancestor had died or whose result could no longer be delivered an orphan.

The system's orphan machinery was not simply a timeout dressed in stronger language. It aimed to ensure that orphans eventually aborted and, crucially, did not observe inconsistent atomic data while wandering after their legitimate ancestry had vanished. The manual also records the uncomfortable operational fact: an unavailable outcome at the caller can coexist with remote activity that is still executing as an orphan.

That makes two common conclusions unsafe. First, failure to receive a result does not prove that nothing ran. Second, forced abort inside the action system does not prove that an unmanaged external effect was retracted. The orphan guarantee relies on actions communicating through atomic data. A motor pulse, a printed page, an email already handed to an outside server, or a human instruction cannot be rolled back merely because an Argus ancestor is gone.

Argus solved a hard problem by defining the state it could control. It did not solve a different problem by pretending the rest of the world was transactional.

Open nesting was a deliberate escape hatch

Ordinary committed subactions remained conditional on their parent. Argus also offered a different construct: a nested topaction. This was open nesting. A nested topaction could commit independently and survive even if its enclosing action later aborted.

That power was useful for side effects that should remain—for example, a deliberately durable coordination record—but it changed the proof. The programmer had to ensure the independent effect was safe and serialized before the parent. If a parent later failed, the nested topaction was not a mysterious leak from atomicity; it was an explicitly chosen exception to the parent's rollback domain.

Modern systems often rediscover this pattern under names such as outbox, saga step or independent audit write. The historical vocabulary is less important than the discipline. An independently committed effect must be identified as such. It must not be smuggled into a report that claims the whole parent operation rolled back without residue.

Commit settled state, not identity or purpose

Argus action identity linked work for concurrency control and recovery. It did not authenticate a human principal. A handler could know arguments, results and action ancestry without knowing which employee, customer or officer supplied the business mandate.

Likewise, serializability is not purpose limitation. Two requests can be equally valid at the object interface while only one has an approved change ticket. An all-or-nothing update can preserve its internal object invariant while violating a rule that spans a payment network, a physical process or an organization. These are not criticisms of the action model. They are reminders to ask the model only the questions it was built to answer.

The correct operational record therefore has layers. The Argus-like transaction record says which guardians and recoverable objects participated, how subactions ended, what the commit decision was and what reached stable storage. An identity record says which execution principal and, where needed, which person initiated or approved the work. External receipts say whether another service, device or human process completed. A broader invariant requires an observation across all of its relevant domains.

The credit boundary matters too

Liskov is the natural entry point because she led the research programme and wrote the mature 1988 overview. But Argus was collective work. Guardians and Actions is by Barbara Liskov and Robert Scheifler and thanks the Argus design group, especially Maurice Herlihy, Paul Johnson and William Weihl. The 1987 reference manual names Liskov, Mark Day, Herlihy, Johnson, Gary Leavens, Scheifler and Weihl. The implementation paper adds Dorothy Curtis alongside Liskov, Johnson and Scheifler.

Preserving those names is not ceremonial. The boundary between a language idea, a recovery protocol, a manual and a working implementation is part of the technical history. Just as commit should not absorb claims about the whole world, one famous name should not absorb the work of the whole system.

Sources