The Big Picture

At the highest level, OpenFlows divides the world into two halves: a control plane where the system's brain lives, and a work plane where disposable agents do the actual coding. Everything else in the architecture serves that split.

Diagram of the OpenFlows system architecture: a control plane (Coder server, the Controller brain, the coordination store, and a database) supervising a work plane of disposable worker workspaces, with a coordination relay joining the two. — The control plane supervises the work plane; a coordination relay joins them.

The control plane

The control plane is where the trusted, long-lived pieces live:

Coder server. Provides identity, the model gateway (the only place AI calls happen), administration, audit, and the ability to create workspaces.
The Controller (the brain). A single long-lived process that runs the whole coordination loop. It is the only component that talks to Coder's API to create workspaces and chats.
The coordination store. A shared store that is the single record of truth for the team's state.
A database for Coder's own bookkeeping.

The work plane

The work plane is where the actual labor happens — and it is deliberately disposable and untrusted.

The NEXUS workspace is long-lived and trusted: it hosts the Controller brain.
Worker workspaces are short-lived and isolated. Each one holds exactly one agent working on one ticket. They are provisioned on demand and torn down when the work is done.

Worker workspaces contain no LLM keys, no raw repository credentials, and have tightly restricted network access. The intelligence they need is served to them from the control plane.

What connects the two

The two planes are joined by:

Provisioning and supervision — the brain creates and monitors workspaces.
The coordination store — both planes read and write the same record of truth (subject to strict write rules).
A coordination relay — used for one specific, live job: letting the reviewer ask the builder's workspace to run a safe command and return evidence.

The mental model

If the control plane is a headquarters and a worker workspace is a job site, then OpenFlows is the management that plans the work, sends a crew to the site, inspects the result from a distance, and approves the delivery — while the job site itself has no copying machine for secrets and is torn down when the work is complete. Settling a messy run is the job of the orchestration loop, which reads reality, repairs what it can, and rises to a human when it cannot.

Two systems, two jobs

Coder governs where agents run; OpenFlows governs how they coordinate. Coder supplies the machines, identities, and the gateway where model calls happen. OpenFlows turns a pile of workspaces into a cooperative team that plans, reviews, recovers, and merges.

This is the whole architecture. Every other page in this section zooms into one corner of this picture.