Causal-Consistency Path Search (CPS)

• Causal-Consistency Path Search (CPS) is a family of formalisms and algorithms that analyze causal consistency by exploring admissible partial orders and local serializations.
• It applies techniques from distributed systems, stateless model checking, and graph-theoretic reasoning to verify consistency of concurrent operations.
• The approach enables systematic detection of forbidden cycles and illegal serializations, optimizing verification with proven efficiency improvements.

Causal-Consistency Path Search (“CPS”, Editor’s term) can be understood as a family of formalisms and algorithms in which causal consistency is analyzed by searching over admissible causal paths, partial-order extensions, per-process serializations, or, dually, by detecting cycle witnesses of inconsistency. In the cited literature, this perspective appears in generalized causal consistency for arbitrary sequential objects, in graph-type and proof-net characterizations of higher-order causal processes, in Datalog reductions for checking distributed database executions, and in DPOR-style stateless model checking of transactional traces (Mostéfaoui et al., 2018, Simmons et al., 2024, Zennou et al., 2020, Abdulla et al., 2022).

1. Conceptual scope and historical setting

Historically, causal consistency had been studied mainly for read/write memory. The central shift introduced in “Extending Causal Consistency to any Object Defined by a Sequential Specification” is that causality is represented by a global partial order over operations, rather than by read-from and write-from relationships alone, and that each process is allowed to interpret the concurrent history through its own causally consistent serialization (Mostéfaoui et al., 2018). This produces a multi-view rather than single-view notion of consistency: different processes may legitimately observe different total orders extending the same partial order.

That reformulation is the clearest abstract basis for CPS. The search problem is no longer “find one global sequential history,” but rather “find a partial order preserving process order, and for each process find a causal-past-constrained serialization compatible with the object specifications.” The data block explicitly identifies this as the formal target criterion relevant to CPS: find a partial order preserving process order, choose for each process a causal-past-constrained serialization, optionally assign return values for remote operations, and verify that each object projection is legal under its sequential specification (Mostéfaoui et al., 2018).

A recurrent misconception is that causal consistency requires one common object history. The generalized account rejects that view. Strong consistency conditions require all processes to see the same sequential order, whereas causal consistency allows each process to have its own view of the execution; the “greatest common view” is the causality partial order, while the linearizations extending it may differ (Mostéfaoui et al., 2018). For CPS, this means the search space is inherently a space of compatible local views rather than a single canonical path.

2. Generalized semantics over concurrent objects

The generalized model starts from a concurrent history

$H=\langle L_1,\ldots,L_n\rangle,$

where each $L_i$ is the local history of sequential asynchronous process $p_i$, the processes cooperate by accessing shared concurrent objects, and the objects are defined by sequential specifications. Operations are generally assumed to be total, and, for exposition in the register case, each register has an initial value written by a fictitious write operation (Mostéfaoui et al., 2018).

The formal definition requires a partial order $\stackrel{po}{\rightarrow}$ on the operations of $H$ such that, for every process $p_i$:

1. process order is respected,

$$(1 \stackrel{i}\rightarrow 2) \Rightarrow (1 \stackrel{po}\rightarrow 2),$$

2. there exists an assignment $Assignment_i$ and a causal past-constrained serialization $S_i$ of $Assignment_i(\stackrel{po}\rightarrow)$ such that

$L_i$0

The role of $L_i$1 is specific and technically important. For operations not issued by $L_i$2, returned values may be replaced by possibly different values in the same return domain; operations issued by $L_i$3 cannot have their returned values changed. This is necessary because, for stacks, queues, dictionaries, and other non-read/write objects, simply deleting remote operations is not adequate: updates affect object state in a richer way than a register write.

Causality remains a partial-order notion. In the read/write case, the execution partial order is the transitive closure of local process order and the write-into relation:

• local process order,
• write-into order,
• transitivity.

A serialization $L_i$4 is any total order extending the partial order, and it is causal past-constrained if, for each operation issued by $L_i$5, only operations in that operation’s causal past can appear before it. This gives CPS its core semantic structure: search over total orders that extend the same causal skeleton but respect local causal pasts.

The same paper supplies an operational realization via causal broadcast. A process invoking $L_i$6 causally broadcasts $L_i$7, waits until the operation is locally processed, and returns the locally stored result. Upon causal delivery of $L_i$8, the process updates its local object state via

$L_i$9

and if $p_i$0, sets $p_i$1. Because each process processes operations in causal order and maintains a local state per object, each local execution yields a serialization compatible with the object specification. The paper also states that replacing causal broadcast by total order broadcast yields linearizability rather than causal consistency (Mostéfaoui et al., 2018). This sharply separates CPS for causal consistency from single-order search for stronger consistency conditions.

3. Execution-level path and cycle characterizations

At the execution level, CPS often appears as cycle detection in derived relations. “Checking Causal Consistency of Distributed Databases” represents an execution as a history

$p_i$2

where $p_i$3 is the set of read/write operations, $p_i$4 is program order, and $p_i$5 is the write-read relation pairing each read with the write that supplied its value. For CC, the paper uses the causal order

$p_i$6

and characterizes violations by finitely many bad patterns. For CCv, it adds the arbitration/conflict layer; for CM, it introduces a per-operation happened-before relation $p_i$7 that propagates through reads-from and program-order prefixes (Zennou et al., 2020).

Model	Derived relation	Violation witness
CC	$p_i$8	CyclicCO, WriteCOInitRead, ThinAirRead, WriteCORead
CCv	$p_i$9	CyclicCF
CM	$\stackrel{po}{\rightarrow}$0	WriteHBInitRead, CyclicHB

The forbidden patterns are explicitly path-shaped. CyclicCO is $\stackrel{po}{\rightarrow}$1. WriteCORead requires writes $\stackrel{po}{\rightarrow}$2 and a read $\stackrel{po}{\rightarrow}$3 on the same variable such that

$\stackrel{po}{\rightarrow}$4

For CCv, the conflict relation is defined by

$\stackrel{po}{\rightarrow}$5

for some read $\stackrel{po}{\rightarrow}$6, and a violation occurs when $\stackrel{po}{\rightarrow}$7 is cyclic. For CM, $\stackrel{po}{\rightarrow}$8 is the smallest transitive relation seeded by causal-order edges in the causal past of $\stackrel{po}{\rightarrow}$9 and extended through reads-from and program order in the prefix of $H$0.

The Datalog reduction maps executions to facts such as rd, wrt, po, wr, sv, and initread, then derives closures and checks integrity constraints. The resulting method is a symbolic path search: recursive rules compute transitive closures, other rules compose paths through wr and po, and violation detection is reduced to the discovery of a cycle or prohibited path shape. The paper states polynomial complexity

$H$1

improving over an earlier $H$2 characterization, and implements the reduction in CausalC-Checker using clingo. On CockroachDB, CC and CCv checking terminate in under about 11.6 seconds for all tested histories, and for histories with 600 operations, CM$H$3 improves runtime by about 8× compared to CM$H$4. On Galera, the tool detected that 1.25% of tested histories violate causal consistency, and 73.3% of the CM violations found were also CC violations (Zennou et al., 2020).

4. Stateless model checking as optimal path search over traces

A second algorithmic form of CPS appears in stateless model checking of transactional programs. “Optimal Stateless Model Checking of Transactional Programs under Causal Consistency” explores traces summarized by program order and reads-from rather than raw interleavings. A trace is represented as

$H$5

or, depending on the model, by extensions such as $H$6 or $H$7, where:

• $H$8 is the set of transactions,
• $H$9 is program order,
• $p_i$0 is reads-from,
• $p_i$1 and blue!70!green_p are model-specific closure relations.

The core trace relations are:

$p_i$2

with the initializer before everything, and

$p_i$3

when transaction $p_i$4 reads a value last written by transaction $p_i$5 on the same variable. Two runs with the same associated traces are treated as equivalent because the assertions to be checked at the end of a run depend only on red and blue.

The CPS mechanism is incremental. When a transaction begins, the search adds a node and a red edge from the previous transaction in the same process. When a read occurs, the search computes a readable set

$p_i$6

branches over all readable source transactions for the read on variable $p_i$7, adds the corresponding blue edge, and then closes the trace under the model-specific consistency obligations. The readable set is precisely a feasibility filter: a transaction is readable iff choosing it does not immediately force a forbidden cycle after adding the implied closure edges.

This search is organized by a DPOR scheme with procedures DPOR(X,P), ExploreTraces(X,\tau,\pi), CreateSchedule, and RunSchedule. CreateSchedule is the backtracking mechanism: when a transaction ends, it scans backward to find earlier read events for which the ended transaction might have been a source but was postponed, then creates schedules that move the postponed source before the earlier transaction while preserving the necessary enabling prefix. The paper’s main theorem is that the algorithm is sound, complete and optimal, and explicitly states that “each consistent red-blue trace is explored exactly once” (Abdulla et al., 2022).

The implementation, Tranchecker, extends Nidhugg, works at LLVM IR level, accepts C programs, dynamically controls execution, generates schedules, replays them, and checks user assertions along generated traces. The experiments include 7507 litmus tests generated using Herd, handled in about 570 seconds total for the five models, as well as classical database benchmarks and applications such as Vote, Twitter, FusionTicket, Auction, Auction-2, and Group (Abdulla et al., 2022). A common misconception is that CPS must enumerate all interleavings; this framework does not. It explores trace classes modulo equivalence induced by red, blue, and the model-specific closures.

5. Graph types, signalling constraints, and proof-net completeness

In higher-order process semantics, CPS is recast as graph reasoning. “A complete logic for causal consistency” works in the $p_i$8 construction, where a base compact closed category $p_i$9 is lifted to a category of higher-order causal processes whose types encode signalling constraints. Objects are pairs

$$(1 \stackrel{i}\rightarrow 2) \Rightarrow (1 \stackrel{po}\rightarrow 2),$$0

and a morphism $$(1 \stackrel{i}\rightarrow 2) \Rightarrow (1 \stackrel{po}\rightarrow 2),$$1 is causal when

$$(1 \stackrel{i}\rightarrow 2) \Rightarrow (1 \stackrel{po}\rightarrow 2),$$2

The construction is designed so that closed diagrams always evaluate to probability $$(1 \stackrel{i}\rightarrow 2) \Rightarrow (1 \stackrel{po}\rightarrow 2),$$3, thereby ruling out causal paradoxes from time loops (Simmons et al., 2024).

The central abstraction is the graph type, which generalizes binary type formers such as $$(1 \stackrel{i}\rightarrow 2) \Rightarrow (1 \stackrel{po}\rightarrow 2),$$4, $$(1 \stackrel{i}\rightarrow 2) \Rightarrow (1 \stackrel{po}\rightarrow 2),$$5, and $$(1 \stackrel{i}\rightarrow 2) \Rightarrow (1 \stackrel{po}\rightarrow 2),$$6 to arbitrary DAGs. The paper defines local graph types, signalling graph types, recursive signalling graph types, and ordered graph types, and proves the key equivalence theorem

$$(1 \stackrel{i}\rightarrow 2) \Rightarrow (1 \stackrel{po}\rightarrow 2),$$7

Thus causal compatibility over a DAG can be characterized equivalently by affine combinations of graph-factorizing local processes, by signalling constraints, or by ordered/topological decompositions. This is the most explicit “CPS-style” theorem in the logical setting: instead of asking directly whether a forbidden signalling path exists, one can ask whether every possible causal ordering compatible with the graph is valid.

The same framework yields standard forms. Graph type depends only on transitive closure,

$$(1 \stackrel{i}\rightarrow 2) \Rightarrow (1 \stackrel{po}\rightarrow 2),$$8

and after pruning edges into or out of first-order vertices one obtains a standard form $$(1 \stackrel{i}\rightarrow 2) \Rightarrow (1 \stackrel{po}\rightarrow 2),$$9 with

$Assignment_i$0

Compatibility of dual graph types is characterized by acyclicity:

$Assignment_i$1

This is the formal “no time loop / no causal paradox” criterion.

The proof-theoretic culmination is a causal proof-net calculus with distinguished first-order atoms. A formula is causally consistent under an interpretation $Assignment_i$2 when the contraction morphism

$Assignment_i$3

is causal. Correctness is determined by up-down switchings: for every switching, the switching graph must be acyclic. The completeness theorem is

$Assignment_i$4

Accordingly, CPS in this setting is the search for a switching-cycle witness: a diagram is valid exactly when there is no causal loop or signalling cycle hidden in any switching of the proof structure (Simmons et al., 2024).

6. Scope, misconceptions, and adjacent path-based causal inference

Three misconceptions are repeatedly ruled out by the cited work. First, causal consistency is not equivalent to a single global history; different processes may have different views extending the same partial order (Mostéfaoui et al., 2018). Second, path search need not be explicit graph enumeration; Datalog saturation and proof-net switching criteria perform symbolic derivation of paths and cycles (Zennou et al., 2020, Simmons et al., 2024). Third, not every path-based causal method is a consistency criterion.

A related but distinct use of path analysis appears in “Causal Discovery from Poisson Branching Structural Causal Model Using High-Order Cumulant with Path Analysis.” That paper studies count-valued causal discovery under a Poisson Branching Structural Causal Model (PB-SCM),

$Assignment_i$5

with binomial thinning

$Assignment_i$6

Its central contribution is to connect high-order cumulants with directed path multiplicity. For a root vertex $Assignment_i$7, if there exist at least two directed paths $Assignment_i$8, i.e.

$Assignment_i$9

then the causal order between $S_i$0 and $S_i$1 is identifiable. More generally, for adjacent $S_i$2, if there exists $S_i$3 such that

$S_i$4

then $S_i$5 is the parent/ancestor of $S_i$6 (Qiao et al., 2024).

This is not a causal-consistency model. It is a path-identification method for observational count data, using cumulant asymmetries to escape bivariate Markov-equivalence ambiguity. Its relevance to CPS is therefore adjacent rather than direct: both lines of work treat path structure as the decisive latent object, but one searches for admissible histories or cycle witnesses of consistency, while the other infers directed structure from cumulants. This suggests that “path search” is a broader methodological pattern across causality research, whereas CPS in the strict consistency sense is specifically about admissible causal orderings, local views, and the absence of forbidden cycles (Qiao et al., 2024).

Taken together, the cited works suggest that CPS is best regarded not as one fixed algorithm, but as a recurrent research pattern. In generalized shared-object semantics it is search over partial orders and local serializations; in database verification it is search over derived execution paths until a bad pattern or cycle is exposed; in stateless model checking it is optimal exploration of po–rf trace classes; and in categorical logic it is acyclicity checking over graph types and proof-net switchings. Across these settings, the invariant idea is the same: represent causality by a structure weaker than a total order, constrain the admissible extensions of that structure, and declare causal consistency exactly when no illegal serialization, signalling path, or cycle witness remains.