00 · ABSTRACT
A workflow is a graph. The graph is the contract.
Deterministic workflow engine. Vendor-neutral provider routing. Four verification primitives derived from the architecture, not configured onto it.
REC 00 ▸ sha256:a402…0c2d ▸ prev 95f0…d4e1 ▸ build 2026-06-12T03:34Z
01 · COMPOSE
State what should happen. Review it like code.
Workflows are declarative, typed YAML living in the repo, so pull requests, CODEOWNERS, and reviewers apply unchanged. The file and the canvas are the same graph.
# sdlc-default · atlas-firmware (Meridian Robotics, demo)
# Excerpt. FIG 1.1 renders the compiled graph.
kind: WorkflowDefinition
metadata:
name: sdlc-default
nodes:
- id: intake
type: trigger
config: { nodeId: linear.issue-assigned }
- id: triage
type: action
config: { nodeId: agent.dispatch_stage, stage: triage }
- id: plan
type: action
config: { nodeId: agent.dispatch_stage, stage: plan }
- id: implement
type: group
stages: [branch, code, self-review, commit]
- id: tests
type: action
config: { nodeId: ci.run_checks, stage: qa }
- id: test-gate
type: gate
config:
gateKind: signal
onFail: { dispatch: refinement, cap: 8 }
- id: review
type: action
config: { nodeId: agent.dispatch_stage, stage: review }
- id: sign-off
type: gate
config: { gateKind: approval }
- id: merge
type: action
config: { nodeId: repo.merge }
# edges omitted in this excerpt
Figures are live component renders, not screenshots. Demo data.
REC 01 ▸ sha256:5f24…8c11 ▸ prev a402…0c2d ▸ build 2026-06-12T03:34Z
02 · COMPILE
Durable state. Replayable. Bounded.
Many platforms run the LLM as the control loop. Rensei takes the opposite stance: the compiler turns the graph into a durable execution plan whose control flow is deterministic code.
State persists at every step boundary, so a run survives crashes and redeploys and replays from the record for audit or selective re-run. LLMs run as bounded operators inside workflow steps: each call captures model version, prompt, and retrieved context, and every transition lands on the hash-chained audit trail.
- 00:19impl-02Bashmake test - 3 failures, re-running torque suite
- 00:13smoke-02Bashgo test ./replay/... - PASS (42/42)
- 00:09review-01Grep"calibration_replay" - 14 matches across 6 files
- 00:04impl-02Editfirmware/torque_sampler.c - guard ISR buffer flush
- 00:00plan-02Readdocs/fleet-sim/reconnect.md
REC 02 ▸ sha256:be75…10ed ▸ prev 5f24…8c11 ▸ build 2026-06-12T03:34Z
03 · SCALE
Three providers in production. The route is earned.
Three model providers run in production at Rensei today: Anthropic, OpenAI, and Google, each running host-session through the local daemon.
The capability matrix documents additional endpoint configurations (Bedrock, Vertex AI, Azure OpenAI, OpenAI-compatible, local), so the deck's larger integration count and this page's production count reconcile on inspection. Per-line provenance and survival measurement are live; the survival-to-posterior wiring is in active integration and closes during the design-partner phase.
Routing IntelligenceHot-path weighting activeThompson sampling · 30-day window
Every task type is a bandit. The fleet keeps a Beta posterior per model arm and routes work to whichever model is actually winning, while still spending a small exploration budget to keep the estimates honest.
Next review task routes to gpt-5.5: highest expected reward, 0.851 with a 95% CI of 0.78–0.92 across 92 observations. gemini-3.5-flash keeps a 12% exploration share on implement, where its interval is still 0.27 wide.
Posterior distributions, Beta(α, β) per model arm
Provider posteriors
Recent decisions
Real product UI · demo data from a fictional fleet (Meridian Robotics), 30-day window
REC 03 ▸ sha256:70b6…496b ▸ prev be75…10ed ▸ build 2026-06-12T03:34Z
04 · INTELLIGENCE
Memory that survives the run.
Each run leaves a knowledge graph behind: code nodes and decision nodes joined by typed, confidence-labeled edges.
AST extraction covers TypeScript and JavaScript; extraction elsewhere is model-assisted. Reads are Cedar-authorized and land on the hash-chained audit trail, feedback weights update by exponential moving average, and the graph is tenant-scoped. Cross-tenant aggregation covers anonymized model-performance priors only.
Knowledge graph
Meridian Robotics · fleet-core · 49 entities · 66 relationships
REC 04 ▸ sha256:0ac6…0c92 ▸ prev 70b6…496b ▸ build 2026-06-12T03:34Z
05 · VERIFY
Four verification primitives run in the execution path.
Cedar policy enforcement, hash-chained audit, fail-closed egress, and decision provenance are properties of the execution graph. The security disclosure walks each one.
Audit log
meridian-robotics/assembly-toolingdemo data · Jun 9, 2026 · UTC- genesis000000…000000
- 13:58:07Issue acceptedintake-serviceMER-2841 · Gripper calibration drifts after firmware flash · P2000000…000000d3c0de…b8656b
- 14:02:31Plan approvedm.alvarez3-step plan · scope: services/calibration · est. smalld3c0de…b8656bd3c0de…22eacd
- Decision
dec_d3c0de24dd1cbinds the model, prompt envelope, retrieved context, and policy ruling to one signed audit entry.Modelclaude-sonnet-4-5version: claude-sonnet-4-5-20250929Prompt envelopetemplate: implementer.dispatch@v12sha256: d3c0dee3c9…b067e2f5d9tokens: 2,113 system · 18,402 inputtools granted: git, fs.write (services/calibration/**), test-runnerRetrieved contextmemobs_mem_a41f2c - “Calibration offsets are written by flash.ts, not the EEPROM map” · w 0.82fileservices/calibration/flash.ts · w 0.74filedocs/runbooks/gripper-calibration.md · w 0.61issueMER-2841 · intake thread (4 messages)Policy ruling · CedarALLOWfleet.dispatch.scoped-write@v7matched rules: allow-implementer-scoped-write, require-branch-isolationpolicy hash: d3c0deebfd…e103274083Cryptographic proofentry hash: d3c0deede1f3360c9c77bee1e4bfbe8cb2eb073fd81df5d241c11d8573ebca0fsequence: 4183signature:ed25519 · DEMOSIGqNdHF/pEQtKdTnhST…(key meridian-audit-2026a)Merkle inclusion: leaf 4183 / tree size 4,187 - 14:19:12Implementation completeimplementer/mr-fleet-02+214 −38 across 6 files · tests green · branch agent/mer-2841d3c0de…ebca0fd3c0de…e52bab
- 14:31:58Review approvedk.tanaka2 comments resolved · approved for merged3c0de…e52babd3c0de…5945d7
- 14:32:20Change mergedmerge-botmerge d3c0de1 → main · checks greend3c0de…5945d7d3c0de…3c339d
- 14:35:00Merkle checkpointaudit-serviceroot sealed · tree size 4,187 · signedd3c0de…3c339dd3c0de…845dc2
REC 05 ▸ sha256:f9fe…6a2c ▸ prev 0ac6…0c92 ▸ build 2026-06-12T03:34Z
06 · INTEGRATIONS
Rensei meets the systems auditors already credit, on their own ground.
No logo wall: each category states what crosses the seam today.
Source control
Agent-authored changes arrive as pull requests in your repositories. Reviews, branch protection, and CODEOWNERS apply unchanged.
Issue tracking
The dispatch loop works the backlog through 17 Linear MCP tools, shipped MIT across the donmai binary and its plugin packages.
Model providers
Anthropic, OpenAI, and Google run in production today; the capability matrix documents additional endpoint configurations (Bedrock, Vertex AI, Azure OpenAI, OpenAI-compatible, local).
Identity
Workspace sign-in runs through single sign-on, and sessions, policy decisions, and audit rows are tenant-scoped by construction.
Audit and SIEM
Audit-chain segments export as signed JSON and verify against the published Ed25519 keys, inside whatever log store the audit team already runs.
MCP tooling
17 Linear and 6 code-intelligence tools, shipped MIT across the donmai binary and its plugin packages; the plugin contract is published in the open-source runtime.
REC 06 ▸ sha256:106e…652d ▸ prev f9fe…6a2c ▸ build 2026-06-12T03:34Z
07 · PATTERNS REJECTED
Three patterns this architecture rejects.
The LLM as the control loop
When the model decides what runs next, the loop can rewrite its own record, and the audit trail becomes another model output. Rensei keeps the control loop in deterministic code; models run inside bounded steps, and every transition lands on the hash-chained audit trail.
The walled garden
A runtime that cannot be inspected asks the buyer to take the execution layer on faith. The execution layer here is MIT-licensed, and the boundary between open source and the commercial control plane is published where anyone can read it.
Framework-only open source
A framework without a runtime ships the hard parts back to the adopter: the daemon, the retries, the operational floor. Donmai is one Go binary with a persistent daemon and a dispatch loop, and the same runtime powers Rensei in production.
REC 07 ▸ sha256:d3fc…5aa3 ▸ prev 106e…652d ▸ build 2026-06-12T03:34Z
08 · CONTACT
Walk this reference against a real workflow.
One person reads this inbox, and every message gets a reply. Bring the workflow you would not hand an agent today, and we will trace it through every chapter above.
REC 08 ▸ sha256:ac5d…e755 ▸ prev d3fc…5aa3 ▸ build 2026-06-12T03:34Z