Causal message delivery ensures that if message A causally precedes message B, every process delivers A before B. The standard approach enforces this at the sender: hold messages until you're sure the recipient has received all causal predecessors. This is conservative — messages wait even when the causal predecessors have already arrived.
Tong, Liittschwager, and Kuper flip the enforcement. Cykas sends messages eagerly — immediately, without waiting — and constrains the recipient's behavior instead. The recipient buffers messages that arrive out of causal order and delivers them only when all predecessors are present. The causal guarantee is the same. The message latency is lower because sending is never delayed.
The inversion matters for workloads with long-running jobs. Under traditional sender-side enforcement, the sender blocks until the recipient acknowledges predecessors, which means long computations at the recipient delay the sender's next message. Under Cykas, the sender fires immediately and the recipient handles ordering locally. Long-running jobs start earlier because they're not waiting for causal metadata to propagate.
The protocol is implemented in Rust and verified with the Stateright model checker — the causal delivery guarantee is machine-checked, not just argued. The verification is the kind of work that makes the protocol trustworthy: distributed protocols are notoriously hard to reason about informally, and model checking exhaustively explores the state space.
The old protocol asked: “Is it safe to send?” The new one sends first and asks: “Is it safe to deliver?” Same guarantee. Different question. Earlier answers.