Procrustes-Bering-Sheaft: Automated Model Discovery and Virtual Crash Tests for Microservices

I. INTRODUCTION

• The representation combines dependencies, replicas, operation-success predicates, and a distribution over component states to assess availability under service and communication failures.Source: §I · p. 1
• Earlier graph discovery and replica-aware simulation studies covered DeathStarBench Social Network and the OpenTelemetry Demo,.A companion study develops identification algorithms and formal analysis [3]; this paper implements the approach with expanded analytical capabilities.Source: §I · p. 1
• The toolchain adds discovery-precondition diagnostics, mandatory-call contracts, SLO failure-tolerance sweeps, baseline regression checks, and component-importance analysis.Versioned handoffs preserve the inputs behind each result.Source: §I · p. 1
• Analytical oracles and archived replay verify the calculations and numerical continuity.Source: §I · p. 1

II. AUTOMATED DISCOVERY AND FAILURE SIMULATION

• Independent command-line interfaces expose the stages and retain their inputs and outputs.Source: §II · p. 1

A. Evidence Preflight and Model Discovery

• Procrustes checks manifests and tracing configuration against an operation goal and scenario, records evidence provenance, and keeps unknown or conflicting evidence explicit.Blocked assessments retain diagnostics, and a command-line option can return a nonzero status.Source: A. Evidence Preflight and Model… · p. 1
• Bering discovers operation-aware dependencies from traces or topology evidence and emits a model, snapshot, and optional quality reports.Overlays supply deployment and endpoint declarations; revised replica declarations are applied when rebuilding the model.Source: A. Evidence Preflight and Model… · p. 1

B. Endpoint Success and Mandatory Calls

• An external predicate contract can require every listed call to succeed, with live endpoints and a reachable caller, so an alternative path cannot replace a mandatory call.Sheaft validates exact Bering edge identifiers and selected modes before analysis.Source: B. Endpoint Success and Mandatory Calls · p. 1
• The runner binds user-declared mandatory calls to discovered edge identifiers and retains every edge.A shared channel connectivity state applies across repeated RPCs within a trial.Source: B. Endpoint Success and Mandatory Calls · p. 1
• Required-call declarations enter Sheaft through an external predicate contract alongside the analysis configuration.Source: Figure 1 · p. 2

C. Failure Simulation and Decision Rules

• A failure profile fixes the population, distribution, trial count, and seed; Sheaft samples states and evaluates the operation predicate to estimate availability.With independent replica failure probability f, a service with r replicas survives with probability 1 − f^r.Source: C. Failure Simulation and Decision Rules · p. 2
• The certified grid tolerance bL is the largest tested level in a contiguous prefix whose lower bounds meet the SLO.An interval spanning the SLO is indeterminate, and an unresolved nonmonotonic sweep cannot certify a blocking boundary.Source: C. Failure Simulation and Decision Rules · p. 2
• Separate boundary rules check a minimum bL and permitted decrease from baseline, while sweep fingerprints determine whether comparisons are compatible.The regression rule compares certified grid metrics, not a confidence bound on change in a continuous threshold.Source: C. Failure Simulation and Decision Rules · p. 2
• In CI/CD fail mode, Sheaft returns 2 for policy failure, 1 for input or runtime errors, and 0 for pass, warn, or report.A delivery pipeline that requires successful gate completion before promotion blocks candidates with nonzero exits.Source: C. Failure Simulation and Decision Rules · p. 2

D. Component Inspection

• Paired Birnbaum analysis forces one service or edge live and failed while preserving other sampled states, estimating importance from pivotal trials.Reports include forced-down impact and perfect-component gain; replicated services use aggregate liveness.Source: D. Component Inspection · p. 2
• Importance analysis supports monotone predicates under independent service or replica sampling without a fault overlay.Each proposed replica change receives a separate evaluation.Source: D. Component Inspection · p. 2

III. DEMONSTRATION: ONE OPERATION, TWO CANDIDATES

• The packaged demonstration uses release v1.3.3, containing Procrustes 0.1.0, Bering 1.0.0, and Sheaft 1.3.1.Source: §III · p. 2
• The demonstration invokes the public tools on recorded observations and fixed candidates, verifies the reference summary, and saves results for replay.Replay needs no application deployment; live evidence collection follows a separate workflow.Source: §III · p. 2

A. From an Observed Request to Its Predicate

• The request succeeds only with HTTP 200 and a nonempty product array whose identifiers are nonempty.The scenario fixes catalog seed data, excludes no product IDs, and disables recommendationCacheFailure.Source: A. From an Observed Request to Its… · p. 2
• Two requests were collected for each of six predeclared states, with recovery checks between conditions.Service faults stopped the container; directed-channel faults prevented reconnection for the whole request.Source: A. From an Observed Request to Its… · p. 2
• Adding required calls matched all six observed states; reachability alone incorrectly predicted success for both individual catalog-channel outages.The comparison uses the same graph and mandatory targets.Source: A. From an Observed Request to Its… · p. 2

B. Reviewing the Replica Changes

• The baseline uses 2/2 recommendation/catalog replicas; the compared additions are 3/1 and 2/2, with equal replica-count budgets.Resource costs are unspecified.Source: B. Reviewing the Replica Changes · p. 3
• 0.934675 for Add R retained the violation, while 0.979900 and bL = 0.12 for Add C restored the baseline estimate and grid tolerance.Add C reproduces the baseline replica counts and sampling settings; its estimates are therefore identical.Source: B. Reviewing the Replica Changes · p. 3
• The reduced model failed endpoint-threshold and boundary rules, and Add R's comparison reported certified_tolerance 0.03 against reference_tolerance 0.12.Separate minimum and regression rules retain both diagnoses; the demo replays prepared candidates while users select changes.Source: B. Reviewing the Replica Changes · p. 3

IV. VALIDATION AND REPRODUCIBILITY

• The declared operation has an independent series-system oracle for checking its availability calculation.The controlled check also models channels retaining one state across repeated RPCs.Source: A. Analytical and Controlled Checks · p. 3
• 0.00228158 maximum absolute discrepancy was below the fixed tolerance 0.006, and all exact availabilities lay within the reported intervals.At f = 0.05, exact values were 0.9801556573 (2/2), 0.9334815784 (2/1), and 0.9357041536 (3/1). Even a perfectly live recommendation service leaves 0.935821 with one catalog replica, so Add R cannot meet the SLO.Source: A. Analytical and Controlled Checks · p. 3
• 15 validation checks passed across Procrustes diagnoses, Bering service/edge/endpoint sets, numerical oracles, policy outcomes, and an unsupported handoff.At f = 0.10, 50,000 trials, and seed 2711, immediate/eventual oracle values 0.9/0.81 yielded 0.89900/0.80914.Source: A. Analytical and Controlled Checks · p. 3

B. Continuity and Re-execution

• 20 archived comparisons across Social Network and OpenTelemetry variants had a maximum absolute difference of 0.001953 from published model values.The comparison uses five profiles per variant.Source: B. Continuity and Re-execution · p. 3
• Replay covers Social Network's 12-service graph with and without replication and OpenTelemetry's 16-service graph under asynchronous and all-blocking interpretations.OpenTelemetry uses a representative graph from a study aggregating graph runs.Source: B. Continuity and Re-execution · p. 3
• The four-configuration replay took about 342 s in the Linux/AMD64 CI job; source builds, container checks, and anonymous image download and execution passed.Archived repeats normalize documented environmental fields and verify 16 files per variant.Source: B. Continuity and Re-execution · p. 3

• The companion identification study reported mean absolute forecast errors within 0.082 percentage points of PMX and a 31.73–100.24-times-faster telemetry-to-first-forecast workflow [3],.Source: §V · p. 3
• MiSim models request processing, CPU scheduling, resilience mechanisms, and time-varying workloads, while Thüring et al. extract architecture and resource inputs from traces.Source: §V · p. 4
• Procrustes–Bering–Sheaft evaluates operation success directly on service and channel states using discovered dependencies, replica declarations, predicates, and failure profiles.This specialized representation supports model-based configuration comparison.Source: §V · p. 4
• µTOM mines µTOSCA descriptions from deployment and interaction evidence, while GMTA groups trace paths into business flows; Bering carries operation identities into failure analysis.Source: §V · p. 4
• PRISM models Retry and Circuit Breaker behavior; ResilienceBench compares implementations under controlled workloads and faults, MicroRes profiles degradation, and Filibuster adds fault injection to functional tests.The toolchain’s primary analysis executes on the dependency model.Source: §V · p. 4

VI. SCOPE AND CONCLUSION

• Execution checks cover one fixed USD request, dataset, cache setting, and six states; replica variants use declared probabilities, while live failover and probability calibration remain outside the experiment.The model covers finite fail-stop states and excludes saturation, queue feedback, and temporal recovery; Wilson intervals are pointwise, with no asserted simultaneous 95% guarantee for the combined policy.Source: §VI · p. 4
• Procrustes–Bering–Sheaft connects evidence diagnostics to failure simulation, component inspection, configuration comparison, and CI/CD gates through independent stages and versioned contracts.Its demonstration links observed dependencies and a checked success condition to two replica changes; analytical oracles and archived replay verify calculation and continuity.Source: §VI · p. 4

DATA AVAILABILITY

• Release v1.3.3 provides pinned tools, plans, HTTP responses, traces, configurations, and reference reports, with separate Docker-replay and live-collection workflows.The release records the container digest and component commits.Source: DATA AVAILABILITY · p. 4