Components and interactions

Start here for the system map. Manager owns product and runtime authority. Coder runs workspaces. Nexus coordinates one tenant; Forge, Sentinel, Vessel, and Lore do ticket-scoped work. The diagrams show the boundaries first, before the sequence diagrams explain individual requests.

The control plane and execution plane

flowchart TB
    user["Signed-in user"] --> manager["OpenFlows Manager"]
    manager --> postgres[(PostgreSQL)]
    manager --> secrets["Secret provider"]
    manager --> coder["Coder"]
    manager --> github["GitHub App"]
    coder --> runtime["Nexus and worker workspaces"]

flowchart TB
    user["Signed-in user"] --> manager["OpenFlows Manager"]
    manager --> postgres[(PostgreSQL)]
    manager --> secrets["Secret provider"]
    manager --> coder["Coder"]
    manager --> github["GitHub App"]
    coder --> runtime["Nexus and worker workspaces"]

Workspaces do not receive Manager's Coder operator credential or GitHub App private key. They authenticate as one registered runtime. Manager is the control plane for provisioning and credential scope, not a proxy for every agent message.

Inside one tenant

flowchart TB
    manager["Manager"] --> nexus["Nexus controller"]
    nexus --> forge["Forge"]
    nexus --> sentinel["Sentinel"]
    nexus --> others["Vessel and Lore"]
    nexus <--> redis[("Tenant Redis")]
    nexus --> artifacts["Shared role artifacts"]

flowchart TB
    manager["Manager"] --> nexus["Nexus controller"]
    nexus --> forge["Forge"]
    nexus --> sentinel["Sentinel"]
    nexus --> others["Vessel and Lore"]
    nexus <--> redis[("Tenant Redis")]
    nexus --> artifacts["Shared role artifacts"]

Forge and Sentinel exchange verification through Nexus's tenant-local A2A relay. Manager provisions and scopes those workspaces, but it is not on the A2A message path. Redis holds the tenant coordination state and is protected by tenant-specific credentials.

Who talks to whom