A workflow is a graph. The graph is the contract.

# sdlc-default · atlas-firmware (Meridian Robotics, demo)
# Excerpt. FIG 1.1 renders the compiled graph.
kind: WorkflowDefinition
metadata:
  name: sdlc-default

nodes:
  - id: intake
    type: trigger
    config: { nodeId: linear.issue-assigned }

  - id: triage
    type: action
    config: { nodeId: agent.dispatch_stage, stage: triage }

  - id: plan
    type: action
    config: { nodeId: agent.dispatch_stage, stage: plan }

  - id: implement
    type: group
    stages: [branch, code, self-review, commit]

  - id: tests
    type: action
    config: { nodeId: ci.run_checks, stage: qa }

  - id: test-gate
    type: gate
    config:
      gateKind: signal
      onFail: { dispatch: refinement, cap: 8 }

  - id: review
    type: action
    config: { nodeId: agent.dispatch_stage, stage: review }

  - id: sign-off
    type: gate
    config: { gateKind: approval }

  - id: merge
    type: action
    config: { nodeId: repo.merge }

# edges omitted in this excerpt

Every saved change snapshots as an immutable version under workflow versioning, so a running instance is immune to edits made on the canvas beside it and a publish that goes wrong rolls back to the version that worked.

State persists at every step boundary, so a run survives crashes and redeploys and replays from the record for audit or selective re-run. LLMs run as bounded operators inside workflow steps: each call captures model version, prompt, and retrieved context, and every transition lands on the hash-chained audit trail.

The inbox is where the rest of this reference meets. The approval a gate holds for a person is the Cedar ruling the security disclosure walks. The row that finishes in place is the run the throughput panel counts. The filed shelf is the audit chain's view of finished work. The design was ruled in August 2026 and ships with the unified session stream; the claims ledger carries it as roadmap.

Interactive sessions put a running harness on whatever screen is at hand. The web view, an iPhone, and an iPad attach to the same session and see the same thing: the swarm sidebar, the terminal, host stats, and the agent-to-agent rail, with one operator holding the pen at a time. The figure runs the open-source Pi harness on a fictional model, which keeps the mechanism in view without favoring a provider. Interactive sessions are live today and carried on the claims ledger as verified, with a walkthrough available on request.

A session is also kept. With recording on for the org, the terminal stream is written as a cast while the session runs, and once it ends anyone entitled to the session can replay it in the platform player: scrub to a moment, change the speed, and read the session record beside it, or tail the same recording as text from the CLI. That is the answer to the question compliance, risk, and security teams ask first, what did the agent actually do, and it holds without a screen recording anyone had to remember to start. Session replay has shipped with interactive sessions since their launch and is carried on the claims ledger as verified. A durable evidence store that checks replays in for the long term, and learning over them, is roadmap.

Additional endpoint configurations (Bedrock, Vertex AI, Azure OpenAI, OpenAI-compatible, local) extend the same model catalog and routing layer beyond the three providers running in production today. That is how a fleet registers a newer arm the week it ships, Muse Spark 1.2, GLM-5.3, or Grok 4.6 beside the current Claude, GPT-5.6, and Gemini tiers in the demo below, and lets the posteriors decide how much of the work it earns. Per-line provenance and survival measurement are live: survival rewards join the routing posteriors by decision id, with propensity recorded for offline evaluation. Live ranking is org opt-in and kill-switched; unopted orgs run in shadow mode.

AST extraction covers TypeScript and JavaScript; extraction elsewhere is model-assisted. Reads are Cedar-authorized and land on the hash-chained audit trail, feedback weights update by exponential moving average, and the graph is tenant-scoped. Cross-tenant aggregation covers anonymized model-performance priors only.

• Cedar policy enforcement
• Hash-chained audit
• Fail-closed egress
• Decision provenance

• Source control

  Agent-authored changes arrive as pull requests in your repositories. Reviews, branch protection, and CODEOWNERS apply unchanged.

• Issue tracking

  The dispatch loop works the backlog through 17 Linear MCP tools, shipped MIT across the donmai binary and its plugin packages.

• Model providers

  Anthropic, OpenAI, and Google run in production today. Additional endpoint configurations (Bedrock, Vertex AI, Azure OpenAI, OpenAI-compatible, local) extend the same routing layer beyond the three.

• Identity

  Workspace sign-in runs through single sign-on, and sessions, policy decisions, and audit rows are tenant-scoped by construction.

• Audit and SIEM

  Audit-chain segments export as signed JSON and verify against the published Ed25519 keys, inside whatever log store the audit team already runs.

• MCP tooling

  17 Linear and 6 code-intelligence tools, shipped MIT across the donmai binary and its plugin packages; the plugin contract is published in the open-source runtime.

• The LLM as the control loop

  When the model decides what runs next, the loop can rewrite its own record, and the audit trail becomes another model output. Rensei keeps the control loop in deterministic code; models run inside bounded steps, and every transition lands on the hash-chained audit trail.

• The walled garden

  A runtime that cannot be inspected asks the buyer to take the execution layer on faith. The execution layer here is MIT-licensed, and the boundary between open source and the commercial control plane is published where anyone can read it.

• Framework-only open source

  A framework without a runtime ships the hard parts back to the adopter: the daemon, the retries, the operational floor. Donmai is one Go binary with a persistent daemon and a dispatch loop, and the same runtime powers Rensei in production.