00 · ABSTRACT
The deterministic runtime that makes agent-authored code defensible in production.
Declarative workflows compile to a durable execution graph. LLMs run as bounded operators inside workflow steps; the control loop is deterministic code. Cedar evaluates policy in the hot path. Entries produced by the current audit append path are hash-linked and carry per-workspace Ed25519 signatures; retained history can include legacy unsigned entries. Decision provenance binds every action.
curl https://rensei.ai/.well-known/audit-keys.jsonverification protocol and key-discovery endpoints, published · the runtime is open source →
8,284
commits across 24 RenseiAI repos, public and private · fetched 2026-09-02
4,933 of them since 2026-06-01, the summer build
2,153 of them in public repos you can count yourself
REC 00 ▸ sha256:5ee4…4562 ▸ prev e057…d895 ▸ build 2026-09-03T21:23Z
“Engineers should not have to --dangerously-skip-permissions their way to the next promotion or termination.”
REC 00b ▸ sha256:2ef9…6ff5 ▸ prev 5ee4…4562 ▸ build 2026-09-03T21:23Z
01 · INBOX
One inbox holds the whole fleet.
Every session a person is entitled to see, across orgs and projects, sits in one list in creation order. What needs them stays full weight, working rows recede, and finished work turns green where it sits. Approvals collect in a tray with a batch verb, and each decision lands on the audit chain. The inbox ships with the unified session stream and is listed in the claims ledger as roadmap.
Figures are live component renders, not screenshots. Demo data.
REC 01 ▸ sha256:3eb0…378a ▸ prev 2ef9…6ff5 ▸ build 2026-09-03T21:23Z
02 · OPERATE
The loop closes bounded and on the record.
Behind every row in that inbox is a session, an issue, and a handoff. Acceptance fails. The issue is auto-rejected. Refinement dispatches in about five seconds, parked behind the active session, capped at eight dispatches per issue. Every transition lands on the audit chain. Governor-level hard caps and holds are on the roadmap and listed in the claims ledger.
- T+00.0sacceptance gateFAILEDsmoke assertion failed on retry policy
- T+00.4sissue auto-rejectedREJECTEDtransition lands on the audit chain
- T+05.1srefinement dispatchedDISPATCHEDparked behind the active session
REC 02 ▸ sha256:bca9…1114 ▸ prev 3eb0…378a ▸ build 2026-09-03T21:23Z
03 · ROUTE
Routing is a posterior, not a preference.
Each dispatch in that topology began as a decision. A permission gate and a viability filter narrow every dispatch to the pools that may and can serve it; Thompson-sampling posteriors per provider and work type then rank the survivors, never widen the set. Exploration stays policy-bounded, and posteriors update from observed session outcomes. Per-line provenance and survival measurement are live: survival rewards join the routing posteriors by decision id, with propensity recorded for offline evaluation. Live ranking is org opt-in and kill-switched; unopted orgs run in shadow mode.
EXAMPLE DECISION TRACE · ILLUSTRATIVE NUMBERS
14 pools considered: 9 excluded for missing os=macos, 3 forbidden by policy v37 data-residency, 2 unhealthy. Zero survive, and the dispatch fails loud, naming every excluded pool and its reason on the decision record. It does not silently downgrade to whichever pool is reachable.
REC 03 ▸ sha256:b478…f519 ▸ prev bca9…1114 ▸ build 2026-09-03T21:23Z
04 · WORKFLOW
One request path. Five layers. Every layer auditable.
The inbox, the topology, and the routing decisions above all run one declared graph. One request path runs Compose to Verify: Compose declares the workflow, Compile turns it into a durable execution graph, Scale routes work across providers, Intelligence persists what the fleet learns, and Verify keeps every step on the record.
REC 04 ▸ sha256:7224…b70f ▸ prev b478…f519 ▸ build 2026-09-03T21:23Z
05 · VERIFY
Four primitives. Properties of the engine.
Everything above lands on the record. Cedar policy enforcement, hash-chained audit, fail-closed egress, and decision provenance are properties of the deterministic execution graph. The security disclosure walks each one.
REC 05 ▸ sha256:9f18…425d ▸ prev 7224…b70f ▸ build 2026-09-03T21:23Z
06 · REMEMBER
The learning compounds. The data does not.
The platform extracts a knowledge graph from agent activity. Reads are Cedar-authorized, every access lands on the hash-chained audit trail, and feedback weights decay on an exponential moving average. Cross-tenant aggregation covers anonymized model-performance priors only.
REC 06 ▸ sha256:2e9a…f374 ▸ prev 9f18…425d ▸ build 2026-09-03T21:23Z
07 · RUNTIME
The execution layer is open source.
Donmai (どんまい) is the MIT-licensed runtime under the platform: one Go binary, a persistent daemon, a dispatch loop. The same runtime powers Rensei in production. The star count is fetched on a daily schedule; the git history is the interesting part.
donmai
4 GitHub stars · fetched 2026-09-02
brew install RenseiAI/homebrew-tap/donmaiREC 07 ▸ sha256:8422…1be4 ▸ prev 2e9a…f374 ▸ build 2026-09-03T21:23Z
08 · RECORD
Published numbers. Declared status.
8,284
commits across 24 repos, public and private · fetched 2026-09-02
4,933
commits since 2026-06-01, the summer build · fetched 2026-09-02
550
releases across the org · fetched 2026-09-02
REC 08 ▸ sha256:1f47…d2e0 ▸ prev 8422…1be4 ▸ build 2026-09-03T21:23Z
09 · CONTACT
Review the architecture with us.
Every message reaches our team and gets a reply. Bring us the runtime thesis you came here for: the workflow whose git history would tell you whether an agent can be trusted with it.
REC 09 ▸ sha256:5a6a…b853 ▸ prev 1f47…d2e0 ▸ build 2026-09-03T21:23Z