Agents and Workers

A workflow-independent agent

The reference agent is intentionally small. It reads the current board, proposes bounded operations, observes explicit errors, and continues until the board accepts completion or the run stops with a visible reason.

Knowledge Actions, Source declarations, and Constitution clauses come from the agent's configured capabilities—not from hard-coded order, finance, or file-processing logic. Tool implementations come from the Worker's local manifest.

Case concurrency

One agent can run multiple case instances. Each instance has its own case ID, board, transcript, lifecycle, and action bindings. The Console's maximum concurrency setting limits how many cases may be active at once.

Concurrency does not create new product identities. Instances are anonymous execution slots under one agent identity and one recipe version.

The Worker boundary

A Worker is a governed execution adapter, not another reasoning agent. It:

1. polls the authorized work queue;
2. atomically claims one action request;
3. resolves the Action's versioned Tool through its pinned local manifest;
4. validates the bound arguments and fences;
5. performs the external operation;
6. returns a structured result with an idempotency key.

The Worker must not invent missing arguments, choose a different action, change board rules, or declare the case complete.

Generic implementations

A general Worker can cover common operations without workflow-specific code: reading and writing bounded files, calling allow-listed HTTP endpoints, querying configured databases, invoking MCP tools, and performing deterministic calculations.

The Capability supplies the Action contract, versioned Tool reference, and portable Source policy. The Agent-owned Worker Connection supplies the authenticated route. The Worker Tool Manifest supplies the exact Tool inventory, Adapter mapping, local credentials, and enforcement.

Adapter	Local Tool implementation	Worker enforcement
http	Relative request path plus bounds	Resolves the endpoint and credentials from the named Source; rejects absolute Tool URLs and undeclared or missing arguments.
mcp	Remote MCP Tool name	Calls only the named MCP Tool on the endpoint resolved from the Source.
db-query	One parameterized query template	Accepts one read-only query, binds values, and caps returned rows.
db-exec-fenced	One parameterized mutation template	Rejects multiple statements and destructive classes before the database call; higher-risk changes still require the configured review path.
run	A relative fixed-program Adapter path	Stays beneath the Worker root, never invokes a shell, and passes dynamic arguments as one JSON value for the fixed program to validate.

Capabilities never carry passwords, tokens, DSNs, private endpoint headers, Adapter details, or Connection identities. Put the Source name and versioned Tool reference in the Action, bind the Source instance to an Agent-owned Worker Connection, and keep implementation plus credentials in the Worker's local manifest and vault. A Tool absent from the pinned manifest remains inert rather than falling back to arbitrary execution.

Adapter is an implementation primitive, not an Agent-facing capability. It is also the fastest way to define a Tool: add a versioned Tool ID, choose an Adapter, name an already-bound Source, and provide its local entry. On first poll the control plane pins only the Tool ID, digest, and Source. A later manifest change is rejected until governance reissues the Connection, making implementation drift visible.

The resulting chain is deliberately one-way:

Agent -> Action -> Tool -> Source -> Connection -> Worker -> Adapter

The model chooses an eligible Action. It cannot choose or rewrite the Tool, Source, Connection, or Adapter.

Deployment shapes

• Process workflows — one agent runtime and one Worker service can handle several isolated cases concurrently.
• Embodied workflows — bind one runtime slot and Worker to a physical device when exclusive ownership is required.
• Enterprise workflows — keep the Console and control plane in Rulith Cloud while Workers run beside private data and systems.