Workflow Authoring

This guide covers the workflow contract that Squid Mesh supports today.

Formatter Setup

Squid Mesh exports formatter rules for workflow DSL calls. Host apps can import them from their .formatter.exs:

[
  import_deps: [:squid_mesh],
  inputs: ["{mix,.formatter}.exs", "{config,lib,test}/**/*.{ex,exs}"]
]

Define A Workflow

Workflows are Elixir modules that use SquidMesh.Workflow and declare:

• one trigger
• one payload contract
• one or more steps
• transitions between steps
• optional dependency-based after: [...] joins on steps that wait for other work
• optional retry policy on the steps that own side effects
• optional recovery markers for irreversible or non-compensatable side effects

defmodule Billing.Workflows.PaymentRecovery do
  use SquidMesh.Workflow

  workflow do
    trigger :payment_recovery do
      manual()

      payload do
        field :account_id, :string
        field :invoice_id, :string
        field :attempt_id, :string
        field :gateway_url, :string
      end
    end

    step :load_invoice, Billing.Steps.LoadInvoice
    step :wait_for_settlement, :wait, duration: 5_000
    step :log_recovery_attempt, :log,
      message: "Invoice loaded, checking gateway status",
      level: :info
    step :check_gateway_status, Billing.Steps.CheckGatewayStatus,
      retry: [max_attempts: 5, backoff: [type: :exponential, min: 1_000, max: 30_000]]
    step :notify_customer, Billing.Steps.NotifyCustomer

    transition :load_invoice, on: :ok, to: :wait_for_settlement
    transition :wait_for_settlement, on: :ok, to: :log_recovery_attempt
    transition :log_recovery_attempt, on: :ok, to: :check_gateway_status
    transition :check_gateway_status, on: :ok, to: :notify_customer
    transition :notify_customer, on: :ok, to: :complete
  end
end

Triggers

Triggers define how a workflow run starts.

Supported trigger types:

• manual()
• cron expression, timezone: "Etc/UTC"

Trigger names are business-oriented entrypoints such as :payment_recovery or :invoice_delivery. The trigger type describes how that entrypoint is invoked.

Current boundary:

• trigger metadata is validated and stored in the workflow definition
• manual triggers are runnable through the public API
• cron triggers are activated by the host app's scheduler and executor

Cron workflow example:

defmodule Content.Workflows.PostDailyDigest do
  use SquidMesh.Workflow

  workflow do
    trigger :daily_digest do
      cron "0 9 * * 1-5", timezone: "Etc/UTC"

      payload do
        field :feed_url, :string, default: "https://example.com/feed.xml"
        field :discord_webhook_url, :string
        field :posted_on, :string, default: {:today, :iso8601}
      end
    end

    step :fetch_feed, Content.Steps.FetchFeed
    step :build_digest, Content.Steps.BuildDigest
    step :post_to_discord, Content.Steps.PostToDiscord,
      retry: [max_attempts: 5, backoff: [type: :exponential, min: 1_000, max: 30_000]]

    transition :fetch_feed, on: :ok, to: :build_digest
    transition :build_digest, on: :ok, to: :post_to_discord
    transition :post_to_discord, on: :ok, to: :complete
  end
end

Host-app scheduler example:

def handle_cron_tick do
  MyApp.SquidMeshExecutor.enqueue_cron(
    SquidMesh.config!(),
    MyApp.Workflows.DailyStandup,
    :daily_standup,
    []
  )
end

Current cron boundary:

• Squid Mesh declares cron intent in the workflow DSL
• the host app performs the actual recurring scheduling
• cron workflow registration is static at boot today

Payload

The trigger payload block defines the run input contract.

payload do
  field :account_id, :string
  field :invoice_id, :string
  field :prompt_date, :string, default: {:today, :iso8601}
end

Supported field types today:

• :string
• :integer
• :float
• :boolean
• :map
• :list
• :atom

Supported defaults today:

• literal values that match the declared field type
• {:today, :iso8601} for ISO-8601 dates generated at run creation time

Payload validation runs before the run is persisted.

Steps

Each step is declared in the Spark-backed workflow spec and is either:

• a native Squid Mesh step module that performs domain work
• a built-in primitive supplied by the runtime
• a raw Jido.Action module used as an explicit interop path

Module step:

step :load_invoice, Billing.Steps.LoadInvoice

Native step modules use Squid Mesh concepts only:

defmodule Billing.Steps.LoadInvoice do
  use SquidMesh.Step,
    name: :load_invoice,
    description: "Loads invoice details",
    input_schema: [
      invoice_id: [type: :string, required: true]
    ],
    output_schema: [
      invoice: [type: :map, required: true]
    ]

  @impl true
  def run(%{invoice_id: invoice_id}, %SquidMesh.Step.Context{} = context) do
    {:ok, %{invoice: %{id: invoice_id, run_id: context.run_id}}}
  end
end

SquidMesh.Step.Context exposes durable Squid Mesh runtime data:

• run_id
• workflow
• step
• attempt
• state, which includes the original payload merged with accumulated run context

Native steps may return:

• {:ok, output} or {:ok, output, opts} for success
• {:error, reason} for terminal failure that skips workflow retries and follows failure routing
• {:retry, reason} or {:retry, reason, opts} for retryable failure governed by the workflow retry policy

When output: :key is declared on the workflow step, Squid Mesh stores the native step's returned map under that key after the step returns. The output_schema validates the native step return before that workflow-level mapping is applied.

Raw Jido.Action modules remain supported for advanced interop. They execute through the same runtime path, but applications should prefer use SquidMesh.Step for the common authoring path.

Built-in steps:

step :wait_for_settlement, :wait, duration: 5_000
step :log_recovery_attempt, :log, message: "Checking gateway status", level: :info
step :wait_for_approval, :pause
approval_step :wait_for_review, output: :approval

Built-in step options supported today:

• :wait requires duration
• :log requires message and accepts level
• :pause intentionally stops the run at that step until an operator resumes it
• approval_step/2 pauses the run for an explicit approve/reject decision and uses :ok or :error transitions to continue
• :wait uses executor-delayed continuation so long waits do not block a worker slot
• :pause is supported in transition-based workflows; dependency-based workflows cannot declare :pause
• approval_step/2 is also transition-based only; dependency-based workflows cannot declare built-in :approval steps

Manual approval example:

approval_step :wait_for_approval, output: :approval
step :record_approval, Billing.Steps.RecordApproval,
  input: [:account_id, :approval],
  output: :approval

step :record_rejection, Billing.Steps.RecordRejection,
  input: [:account_id, :approval],
  output: :approval

transition :wait_for_approval, on: :ok, to: :record_approval
transition :wait_for_approval, on: :error, to: :record_rejection
transition :record_approval, on: :ok, to: :complete
transition :record_rejection, on: :ok, to: :complete

When a run is paused at an approval step, inspect it as usual and then approve or reject it through the public API:

{:ok, paused_run} = SquidMesh.inspect_run(run_id, include_history: true)
{:ok, approved_run} = SquidMesh.approve_run(run_id, %{actor: "ops_123"})
{:ok, rejected_run} = SquidMesh.reject_run(run_id, %{actor: "ops_456"})

With include_history: true, the inspected run also exposes audit_events so host apps can show who paused, resumed, approved, or rejected the run and when:

Enum.map(paused_run.audit_events, &{&1.type, &1.step})
#=> [{:paused, :wait_for_approval}]

Manual-review durability notes:

• approval_step/2 is only supported in transition-based workflows
• the approval step stays :running while the run is :paused
• approve_run/3 completes that step and advances the declared :ok path
• reject_run/3 completes that step and advances the declared :error path
• reviewer identity, decision, timestamp, and optional review metadata are persisted in the completed step output and merged run context
• inspect_run(..., include_history: true) also returns durable audit events for pause, resume, approval, and rejection actions
• the resolved :ok and :error targets plus output-mapping metadata are persisted with the paused step so restart or deploy boundaries do not recompute review semantics from the current workflow definition
• host apps should apply the latest Squid Mesh migrations before using pause-resume in existing environments

Local Repo Transactions

Use transaction: :repo when one module step needs to run several same-process host repo writes under one local Ecto transaction:

step :post_local_ledger_entries, Billing.Steps.PostLocalLedgerEntries,
  transaction: :repo

This option is intentionally narrower than the durable workflow. It wraps only the custom action's run/2 callback in config.repo.transaction/1. If that callback returns {:error, reason} or raises, the local repo writes made inside the callback roll back and Squid Mesh then records the failed step attempt in its normal durable history.

The boundary is not a distributed transaction:

• Squid Mesh still persists run, step, attempt, retry, and dispatch state after the action returns
• downstream steps and saga compensation callbacks are outside the local transaction
• external systems called by the action are not atomically reversible
• built-in steps cannot declare transaction: :repo
• transactional steps run in the worker process so Ecto can use the same checked-out transaction connection

Use this for small local database groups such as "insert a parent row plus children" or "reserve and capture two local ledger records". Use saga compensation or explicit :error transitions for work that crosses process, queue, service, or workflow-step boundaries.

Irreversible Steps

Use recovery markers when a step performs a side effect that should not be treated as safely repeatable or undoable.

step(:capture_payment, Billing.Steps.CapturePayment, irreversible: true)
step(:send_receipt, Billing.Steps.SendReceipt, compensatable: false)

irreversible: true means the step's effect cannot be undone in the workflow's domain. Squid Mesh treats it as non-compensatable. compensatable: false is for steps that may not be strictly irreversible but still have no reliable application-owned compensation path.

Both markers produce the same replay safety behavior:

• inspect_run(..., include_history: true) includes each step's recovery policy
• explain_run/2 removes :replay_run from terminal next actions after a completed marked step and reports the blocking step in details.replay
• replay_run/2 returns {:error, {:unsafe_replay, details}} by default after a completed marked step
• replay_run(run_id, allow_irreversible: true) is the explicit operator override when re-execution has been reviewed and accepted

These markers do not provide exactly-once delivery or external compensation. They keep Squid Mesh honest about recovery policy so a replay cannot silently repeat a payment capture, notification, or other non-compensatable effect.

Saga Compensation

Use compensate: SomeAction when a completed step has a domain-level inverse operation that should run if a later step fails and the workflow cannot continue. This is rollback, not same-step fallback. Same-step fallback stays modeled as an :error transition.

step :reserve_inventory, Billing.Steps.ReserveInventory,
  compensate: Billing.Steps.ReleaseInventory

step :authorize_payment, Billing.Steps.AuthorizePayment,
  compensate: Billing.Steps.VoidAuthorization

step :capture_payment, Billing.Steps.CapturePayment, retry: [max_attempts: 2]

transition :reserve_inventory, on: :ok, to: :authorize_payment
transition :authorize_payment, on: :ok, to: :capture_payment
transition :capture_payment, on: :ok, to: :complete

When :capture_payment exhausts its retry policy and has no :error transition, Squid Mesh compensates previously completed compensatable steps in reverse completion order. In this example it voids the payment authorization, then releases inventory. Failed steps are not compensated because their forward effect did not complete.

Compensation callbacks are Jido.Action modules. They receive the original payload, current run context, the completed step's input and output, and the terminal failure:

def run(%{step: %{output: %{inventory_reservation: reservation}}}, _context) do
  {:ok, %{released_inventory: Map.put(reservation, :status, "released")}}
end

inspect_run(..., include_history: true) exposes compensation status and output under each completed step's recovery.compensation field. Compensation callbacks are not governed by the forward step's retry policy; forward retries exhaust before rollback starts, and callback failures are persisted under recovery.compensation for inspection. Write callbacks to be idempotent so a host app can safely redeliver or repair failed compensation work.

Compensation And Undo Routes

Error transitions can declare whether the routed recovery step is compensation or undo:

transition(:capture_payment, on: :error, to: :issue_credit, recovery: :compensation)
transition(:reserve_inventory, on: :error, to: :release_inventory, recovery: :undo)

Use recovery: :compensation when the next step reconciles or finishes partial work with a forward action, such as issuing a credit after a payment capture cannot continue. Use recovery: :undo when the next step reverses application- owned local work, such as releasing a reservation that the workflow can still control.

The marker does not change retry behavior. Squid Mesh still retries the failed step first when a retry policy exists, then routes through the error transition only after retries are exhausted. When the route is chosen, inspect_run(..., include_history: true) exposes it in the failed step's recovery.failure field and adds an audit event:

%{
  failure: %{strategy: :compensation, target: :issue_credit}
}

Audit event types are :compensation_routed and :undo_routed, with the target step in event metadata.

Step Modules

Custom steps typically use Jido.Action and return workflow output in a plain map.

defmodule Billing.Steps.CheckGatewayStatus do
  use Jido.Action,
    name: "check_gateway_status",
    description: "Checks gateway state",
    schema: [
      invoice: [type: :map, required: true],
      gateway_url: [type: :string, required: true]
    ]

  @impl true
  def run(%{invoice: invoice, gateway_url: gateway_url}, _context) do
    case SquidMesh.Tools.invoke(SquidMesh.Tools.HTTP, %{method: :get, url: gateway_url}) do
      {:ok, result} ->
        {:ok, %{gateway_check: %{invoice_id: invoice.id, status: result.payload.body}}}

      {:error, error} ->
        {:error, SquidMesh.Tools.Error.to_map(error)}
    end
  end
end

Step result contract:

• success: {:ok, map()}
• failure: {:error, map()}

Data Flow Between Steps

Each run starts with its validated payload.

When a step succeeds:

• Squid Mesh merges the returned map into the run context
• the next step receives the original payload merged with the accumulated context

That means later steps can use values produced by earlier steps without manual state persistence in the host application.

If you want a step to consume only a subset of the available data, declare an explicit input mapping:

step :load_account, Billing.Steps.LoadAccount, input: [:account_id], output: :account
step :send_email, Billing.Steps.SendEmail, input: [:account, :invoice_id], output: :delivery

In that example:

• :load_account receives only %{account_id: ...}
• its returned map is stored under :account
• :send_email receives only %{account: ..., invoice_id: ...}
• its returned map is stored under :delivery

Current boundary:

• run context is still a flat merged map
• explicit input: [...] lets a step declare which keys it consumes
• explicit output: :key lets a step namespace its returned map under one top-level key
• dependency-based workflows with parallel branches should still emit disjoint top-level keys unless they intentionally namespace outputs
• if multiple parallel branches write the same key, the result is not a stable workflow contract today

Dependency-Based Steps

Steps can also wait on explicit dependencies instead of success transitions:

step :load_account, Billing.Steps.LoadAccount
step :load_invoice, Billing.Steps.LoadInvoice
step :prepare_notification, Billing.Steps.PrepareNotification,
  after: [:load_account, :load_invoice]

Choose dependency-based steps when you want to model prerequisites and joins. They can still express a sequential chain such as step_2 after: [:step_1] and step_3 after: [:step_2], but if the workflow is only a straight ordered path, transition/2 is usually the clearer fit because it states the next step directly.

Use transition/2 when the workflow is a single ordered path and each step chooses the next step by outcome. Use after: [...] when a step should wait for one or more prerequisite steps, especially when multiple root steps fan in to a join step.

In the example above, :load_account and :load_invoice are independent root steps. Squid Mesh does not need a transition between them because neither one depends on the other. They may be enqueued independently, and :prepare_notification becomes runnable only after both have completed.

after: [...] makes a step runnable only after every named dependency completes successfully. Omit the option entirely for root steps; after: [] is not valid because it changes execution semantics without adding a dependency edge. Dependency workflows do not mix with transition/2 in this slice.

Fan-Out And Fan-In Contract

Dependency-based workflows model static graph fan-out and fan-in. A root step is any declared step without after: [...]. Multiple root steps may be scheduled as independent runnable work for the same run. A join step is any step with one or more dependencies; it becomes runnable only after every declared dependency has completed successfully.

Squid Mesh treats Runic-ready work as workflow runnable intent. In the current runtime, that intent is represented by scheduled step rows and host-executor jobs. In the Jido-native runtime path, the same readiness maps to durable dispatch entries before live wakeups are considered successful. Either way, the workflow contract is the same: readiness comes from persisted step state, not from Oban or any other specific executor's concurrency model.

Sibling behavior:

• sibling root steps may run in either order, or concurrently when the host executor delivers them concurrently
• a join waits while any dependency is still pending or running
• a join is not scheduled after a sibling reaches terminal failure
• a sibling retry keeps the run in retrying state until the retry is delivered and the dependency completes
• cancellation and terminal run transitions prevent newly unlocked join work from being dispatched

Inspection and explanation reflect this graph state. With history enabled, inspect_run/2 shows declared dependency edges and whether each step is pending, running, completed, failed, or waiting. explain_run/2 reports a waiting join with the dependencies it is waiting on and their current statuses; once the join is scheduled, the explanation points at the runnable join step and lists the dependencies that satisfied it.

Current dependency validation requires:

• every after: reference names a declared step
• the dependency graph is acyclic
• workflows may define multiple entry steps when dependency execution is used
• after: [] is rejected because it changes execution semantics without adding an edge
• dependency-based workflows cannot also declare transition/2
• dependency-based workflows cannot declare built-in :pause or :approval steps; use transition-based workflows for those manual wait points today

Current execution boundary:

• a step becomes runnable only after every dependency has completed successfully
• multiple ready root steps can be enqueued independently while later phases still respect deterministic dependency order
• the current scheduler resolves dependency readiness from persisted step history after each successful dependency step, so it is intended for small and medium graph workflows
• downstream work is only enqueued from a locked run-progression boundary, so a sibling terminal failure prevents later dispatch

Transitions

Transitions define the path through the workflow.

transition :check_gateway_status, on: :ok, to: :notify_customer
transition :check_gateway_status, on: :error, to: :notify_operator
transition :notify_customer, on: :ok, to: :complete

Current workflow validation requires:

• at least one step
• exactly one trigger
• exactly one workflow entry step for transition-based workflows
• dependency-based workflows expose entry_steps plus initial_step; the singular entry_step is nil
• transitions only use supported outcomes: :ok and :error
• transitions reference known steps
• each {from, on} pair is declared at most once

Retries And Backoff

Retry policy lives on the step that owns the work:

step :check_gateway_status, Billing.Steps.CheckGatewayStatus,
  retry: [max_attempts: 5, backoff: [type: :exponential, min: 1_000, max: 30_000]]

Supported retry options today:

• max_attempts
• backoff: [type: :exponential, min: ..., max: ...]

Squid Mesh resolves workflow retry policy and asks the host executor to schedule the next step attempt. If a step also declares an on: :error transition, Squid Mesh takes that route only after retries are exhausted.

Starting Runs

If a workflow defines a single trigger, the short path is:

SquidMesh.start_run(Billing.Workflows.PaymentRecovery, %{
  account_id: account_id,
  invoice_id: invoice_id,
  attempt_id: attempt_id,
  gateway_url: gateway_url
})

If you want to name the trigger explicitly:

SquidMesh.start_run(Billing.Workflows.PaymentRecovery, :payment_recovery, %{
  account_id: account_id,
  invoice_id: invoice_id,
  attempt_id: attempt_id,
  gateway_url: gateway_url
})

Current Boundaries

The current workflow contract is intentionally smaller than a full graph engine.

Supported today:

• one trigger per workflow
• sequential transitions with explicit :ok and :error outcomes
• dependency-based joins with after: [...]
• durable retries and replay
• built-in :wait, :log, :pause, and :approval steps

Not implemented today:

• parallel dispatch of multiple ready steps
• conditional branching beyond transition outcomes
• dynamic cron registration after boot
• custom reclaim logic for interrupted in-flight step ownership