Hello, I am trying to design the CDDLM deployment API in the WS-RF style, and am having problems with understanding the best way to make effective use of resource lifetimes in a fault-tolerant environment. I would like some assistance : Scenario ======== -We are supporting automated deployment of applications to allocated resources. -Applications are deployed through a deployment portal; the applications may deployed on hosts that are not running the services necessary for direct communication, or behind a firewall. -The deployment portal is in a DMZ or otherwise reachable by all callers. All EPRs must therefore refer to the portal. I had originally envisaged that to destroy an application,a <wsrl:Destroy/> call could be made. Yet I have a problem. I want to be fault tolerant without relying on load balancing routers, round-robin DNS or mDNS hostnames. In the stateful resources pattern, I can have EPRs that contain policy on how to renew an EPR. Presumably that would list a service group location from whence any other deployment portal EPR could be found that could renew an invalid EPR for us (e.g. by extracting application identification info and constructing a new EPR referring to the local portal) This all seems workable, ignoring the problem of specifying the policy of updating EPRs. Presumably we'd have to do an app specific algorithm and policy. What is causing me trouble is resource lifetimes. Once I have a world in which you can have multiple EPRs all referring to the same resource, the same deployed application, what does that mean for WS-ResourceLifetime? If I have multiple, different EPRs, is it right that a <wsrl:Destroy/> call on one of them should terminate the final application? What if there was state on each portal related to the EPR that needed cleaning up at the end of a conversation, and so required either that destroy call, or timeout-initiated destruction? I think the problem here is "what should I be modelling with the implicit resource pattern"? . Is it:- (a) the resource in question *is* the application. When the resource is destroyed, so is the application. (b) the resource in question is merely a view of the application. When the resource is destroyed, the view goes away, but the application remains until destroyed by some other means. -Steve