OpenFlows for engineering organizations

Agent work your team can actually account for.

Turn a GitHub issue into a reviewed pull request with clear ownership, isolated workspaces, scoped credentials, and a record of what happened along the way.

Plan an evaluation Explore the architecture

Open source at the core. Customer-managed deployments can be evaluated today.

One governed run ISSUE → PR

Issue enters the queueRepository and tenant are known

GitHub

Manager authorizes workIdentity, scope, capacity, credentials

Control plane

Agents work in CoderNexus coordinates isolated workspaces

Runtime

Evidence reaches reviewChanges, verification, pull request

Human gate

The agent does the work. Your team keeps the decision.

From issue to review

One workflow, with visible handoffs.

OpenFlows separates product authority from execution. Manager decides what a runtime may do; Nexus coordinates work inside one tenant; Forge and Sentinel work in separate Coder workspaces.

01 / Connect

Choose a repository

02 / Provision

Start the runtime

Manager records durable operations and asks Coder to create the tenant controller and scoped worker workspaces.

03 / Execute

Run the issue

Nexus assigns ticket work. Agents use registered runtime sessions and request only the credentials their task permits.

04 / Review

Inspect the evidence

Changes and verification return through the tenant workflow before a human decides whether to merge.

Walk through a first issue

Trust boundaries

Give each runtime the authority it needs, not the keys to the platform.

The security model is defined by which system holds each credential and how a workspace proves its identity. We document these boundaries so your security team can inspect and test them.

Trusted control plane

Manager keeps platform authority

GitHub App signing material, the Coder operator credential, and the encryption key remain outside agent workspaces. Manager resolves organization, tenant, workspace, and repository scope on privileged requests.

Inspect the security model →

Tenant execution plane

Workspaces receive limited access

A workspace registers with a one-time bootstrap, then uses a runtime session. GitHub installation tokens are short-lived and repository-scoped. Tenant Redis uses a tenant credential and namespace.

Inspect credential lifecycles →

Recovery and audit

Work can be resumed and examined

Provisioning operations use database leases and idempotency keys. Tenant coordination records include assignments, heartbeats, hooks, and A2A evidence. Operators remain responsible for securing the supporting services.

Inspect operations →

Deploy with intent

Run the control plane alongside your engineering systems.

A customer-managed evaluation uses the same Manager-mediated runtime architecture described in the public docs. There is no separate, simplified enterprise runtime to trust.

See service connections

What you operate

OpenFlows ManagerProduct API, credential broker, hook ingress, and durable workers
PostgreSQL and RedisControl-plane records and tenant coordination
Coder and a provisionerTemplates, builds, and workspace execution
Secret provider and public HTTPS originPlatform credentials, runtime bundles, and GitHub callbacks

Review installation prerequisites →

Availability

Start with the model you can run today.

The open-source platform and customer-managed deployment are available to evaluate. Enterprise operating requirements need a direct conversation. An OpenFlows-operated service is planned, not available today.

Available to evaluate

Open source, customer-managed

Deploy the documented services in your own environment and validate one repository and tenant end to end.

Discuss requirements

Enterprise operating needs

Share identity, policy, support, and audit requirements with the project. Availability and scope require a direct conversation.

Not available yet

OpenFlows-operated service

A hosted operating model is planned. This page does not present it as a service you can sign up for today.

Start with proof

Evaluate one repository before you scale the platform.

Use a contained pilot to test the real boundaries: GitHub connection, tenant provisioning, runtime registration, issue execution, review evidence, and recovery after a worker interruption.

Read the setup guide Discuss your requirements

01
Prepare Manager, Coder, PostgreSQL, Redis, secrets, and GitHub integration.
02
Connect one repository, create a tenant, and confirm runtime heartbeats.
03
Run a representative issue and inspect the resulting PR and verification evidence.
04
Review credential scope, operation recovery, and operator logs with your security team.