00 · ABSTRACT # A workflow is a graph. The graph is the contract. Deterministic workflow engine. Vendor-neutral provider routing. Four verification primitives derived from the architecture, not configured onto it. [Review the architecture with us](https://rensei.ai/platform#chapter-09) [Read the docs](https://rensei.ai/docs) 01 · COMPOSE ## State what should happen. Review it like code. Workflows are declarative, typed YAML living in the repo, so pull requests, CODEOWNERS, and reviewers apply unchanged. The file and the canvas are the same graph. FIG 1.0 *FIG 1.0 - SDLC workflow definition, YAML excerpt. FIG 1.1 renders the compiled graph.* FIG 1.1 *FIG 1.1 - The compiled execution graph replaying one run: the test gate fails, refinement re-enters implement, the second pass merges.* Every saved change snapshots as an immutable version under [workflow versioning](https://rensei.ai/docs/workflows/versioning) , so a running instance is immune to edits made on the canvas beside it and a publish that goes wrong rolls back to the version that worked. Figures are live component renders, not screenshots. Demo data. 02 · COMPILE ## Durable state. Replayable. Bounded. Many platforms run the LLM as the control loop. Rensei takes the opposite stance: the compiler turns the graph into a durable execution plan whose control flow is deterministic code. State persists at every step boundary, so a run survives crashes and redeploys and replays from the record for audit or selective re-run. LLMs run as bounded operators inside workflow steps: each call captures model version, prompt, and retrieved context, and every transition lands on the hash-chained audit trail. FIG 2.0 Replay 2026-06-09 *FIG 2.0 - Fleet topology with the sessions stream: agents, issues, and dispatch updates replayed on a scripted loop.* 03 · OPERATE ## Every session reports to one inbox. A user-scoped inbox lists every session the user is entitled to see across their orgs and projects: one active list in creation order, with urgency carried by badge and never by position. Approvals, interview questions, and requests for input collect in a tray above the list, so thirty parallel approvals are one row with a batch verb, and every decision lands on the audit chain. The inbox is where the rest of this reference meets. The approval a gate holds for a person is the Cedar ruling the security disclosure walks. The row that finishes in place is the run the throughput panel counts. The filed shelf is the audit chain's view of finished work. The design was ruled in August 2026 and ships with the unified session stream; the claims ledger carries it as roadmap. FIG 3.0 *FIG 3.0 - Fifteen minutes of a two-org fleet replayed in the user-scoped inbox. Rows hold their positions, badges carry urgency, and finished sessions move to the filed shelf.* Interactive sessions put a running harness on whatever screen is at hand. The web view, an iPhone, and an iPad attach to the same session and see the same thing: the swarm sidebar, the terminal, host stats, and the agent-to-agent rail, with one operator holding the pen at a time. The figure runs the open-source Pi harness on a fictional model, which keeps the mechanism in view without favoring a provider. Interactive sessions are live today and carried on the claims ledger as verified, with a walkthrough available on request. FIG 3.1 *FIG 3.1 - One session followed from an iPad and an iPhone: Pi harness, fictional model, swarm sidebar, host stats, agent-to-agent rail.* A session is also kept. With recording on for the org, the terminal stream is written as a cast while the session runs, and once it ends anyone entitled to the session can replay it in the platform player: scrub to a moment, change the speed, and read the session record beside it, or tail the same recording as text from the CLI. That is the answer to the question compliance, risk, and security teams ask first, what did the agent actually do, and it holds without a screen recording anyone had to remember to start. Session replay has shipped with interactive sessions since their launch and is carried on the claims ledger as verified. A durable evidence store that checks replays in for the long term, and learning over them, is roadmap. FIG 3.2 *FIG 3.2 - The recording of the same session, replayed at 2x in the platform player: transport, seek bar, speed, and the session record with its recording policy.* 04 · SCALE ## Three providers in production. The route is earned. Three model providers run in production at Rensei today: Anthropic, OpenAI, and Google, each running host-session through the local daemon. Additional endpoint configurations (Bedrock, Vertex AI, Azure OpenAI, OpenAI-compatible, local) extend the same [model catalog and routing layer](https://rensei.ai/docs/model-routing/catalog-and-routing) beyond the three providers running in production today. That is how a fleet registers a newer arm the week it ships, Muse Spark 1.2, GLM-5.3, or Grok 4.6 beside the current Claude, GPT-5.6, and Gemini tiers in the demo below, and lets the posteriors decide how much of the work it earns. Per-line provenance and survival measurement are live: survival rewards join the routing posteriors by decision id, with propensity recorded for offline evaluation. Live ranking is org opt-in and kill-switched; unopted orgs run in shadow mode. FIG 4.0 *FIG 4.0 - Thompson posteriors per provider, issue throughput, and code survival. Survival-to-posterior wiring: verified, decision-id joined.* 05 · INTELLIGENCE ## Memory that survives the run. Each run leaves a knowledge graph behind: code nodes and decision nodes joined by typed, confidence-labeled edges. AST extraction covers TypeScript and JavaScript; extraction elsewhere is model-assisted. Reads are Cedar-authorized and land on the hash-chained audit trail, feedback weights update by exponential moving average, and the graph is tenant-scoped. Cross-tenant aggregation covers anonymized model-performance priors only. FIG 5.0 *FIG 5.0 - Knowledge-graph explorer over a fictional codebase: search, legend filters, detail panel.* 06 · VERIFY ## Four verification primitives run in the execution path. Cedar policy enforcement, hash-chained audit, fail-closed egress, and decision provenance are properties of the execution graph. The security disclosure walks each one. - [Cedar policy enforcement](https://rensei.ai/security#cedar) - [Hash-chained audit](https://rensei.ai/security#audit) - [Fail-closed egress](https://rensei.ai/security#egress) - [Decision provenance](https://rensei.ai/security#provenance) FIG 6.0 *FIG 6.0 - Audit-chain verification with one expanded decision-provenance row: model, prompt envelope, Cedar permit, policy hash.* 07 · INTEGRATIONS ## Rensei meets the systems auditors already credit, on their own ground. No logo wall: each category states what crosses the seam today. - Source control Agent-authored changes arrive as pull requests in your repositories. Reviews, branch protection, and CODEOWNERS apply unchanged. - Issue tracking The dispatch loop works the backlog through 17 Linear MCP tools, shipped MIT across the donmai binary and its plugin packages. - Model providers Anthropic, OpenAI, and Google run in production today. Additional endpoint configurations (Bedrock, Vertex AI, Azure OpenAI, OpenAI-compatible, local) extend the same routing layer beyond the three. - Identity Workspace sign-in runs through single sign-on, and sessions, policy decisions, and audit rows are tenant-scoped by construction. - Audit and SIEM Audit-chain segments export as signed JSON and verify against the published Ed25519 keys, inside whatever log store the audit team already runs. - MCP tooling 17 Linear and 6 code-intelligence tools, shipped MIT across the donmai binary and its plugin packages; the plugin contract is published in the open-source runtime. 08 · PATTERNS REJECTED ## Three patterns this architecture rejects. - The LLM as the control loop When the model decides what runs next, the loop can rewrite its own record, and the audit trail becomes another model output. Rensei keeps the control loop in deterministic code; models run inside bounded steps, and every transition lands on the hash-chained audit trail. - The walled garden A runtime that cannot be inspected asks the buyer to take the execution layer on faith. The execution layer here is MIT-licensed, and the boundary between open source and the commercial control plane is published where anyone can read it. - Framework-only open source A framework without a runtime ships the hard parts back to the adopter: the daemon, the retries, the operational floor. Donmai is one Go binary with a persistent daemon and a dispatch loop, and the same runtime powers Rensei in production. 09 · CONTACT ## Walk this reference against a real workflow. Bring the workflow you would not hand an agent today. We will trace how approvals surface to the operator inbox, how policy evaluates before action, and how the entire run replays from the record. --- Canonical: https://rensei.ai/platform Site index: https://rensei.ai/llms.txt Docs: https://rensei.ai/docs OpenAPI: https://rensei.ai/openapi.json