maestro

Orchestration engines have error handlers but no agents that own a workflow, and AI chat harnesses have agents but no orchestration substrate. Nobody ships the workflow with an operator attached. That gap is the whole idea.

The atom is a Module: a runnable in some engine, a 1:1 operator agent auto-named after a composer, and its own config and memory. One agent per workflow rather than a super-agent watching everything — each one knows only its own runnable, so context stays tight, blast radius stays small, and the fleet scales by addition. A durable failure queue ingests every failure event over a webhook with a poll backstop, and the agent root-causes against its memory of past incidents.

Every change is gated. The effective zone is the stricter of the Module's autonomy ceiling and the change's own impact: green may auto-apply, yellow proposes and waits for a human, red stops and flags — and anything touching egress, exec or the environment is red-railed. There is no silent autonomous apply outside a Module explicitly opted into green, and every apply is snapshot-first and reversible in one click.

The engine is deliberately a commodity. Windmill plugs in behind an adapter first, with n8n and Temporal to follow, so the differentiated part stays the part you own. It runs entirely on your own machine — Postgres plus your choice of compute, local Ollama or hosted Claude, selectable per agent and per verb — so your workflows and data never have to leave the host.