Conductor

Approve to resume

<2s

Lost runs on crash

0

Apps: web, server, worker

3

Per-org encrypted key

BYOK

Architecture

Three deployable apps over a shared core, with Temporal as the execution source of truth:

apps/web ──HTTP/WS──> apps/server ──client──> Temporal ──dispatch──> apps/worker
                          │  └─subscribe─> Redis <─publish── activities ─┘
                          └─read──────────> PostgreSQL <─projection writes─┘
                                       activities ──LLM──> OpenRouter (AI SDK)

• apps/web (Next.js dashboard) talks only to the server over HTTP and WebSocket with a bearer JWT. It owns no business logic and never touches Temporal, Postgres, or Redis.
• apps/server (Fastify) hosts Better Auth organizations, REST routes, the Temporal client, the WebSocket relay, and the Redis subscriber. It runs no AI work and no long-lived jobs.
• apps/worker (Temporal worker) keeps workflows/ as a deterministic sandbox and activities/ for every side effect: LangGraph agents, OpenRouter calls, Postgres and Redis writes.
• packages/shared holds Zod schemas, types, and AES-256-GCM crypto. packages/db holds the Drizzle schema and org-scoped repository factories shared by server and worker, so tenancy scoping lives in one codebase. Apps never import from each other.

How a run works

1. Launch from a template or canvas

   An operator opens a template (Blog Post Pipeline, SEO Brief, Competitor Research), fills a typed form, and hits launch. No code. The same graph_spec can be authored visually on the React Flow canvas at /canvas, validated live by the shared Zod schema and versioned with immutable history.

2. Durable execution begins

   The generic interpreter workflow runs the versioned graph_spec, each node a Temporal activity wrapping a LangGraph.js sub-graph with per-activity retry policies and timeouts. A crashed worker's in-flight activity is re-dispatched automatically.

3. Pause at the approval gate

   The run suspends on a Temporal signal plus condition(), holding no worker slot. The approver sees the full research findings and draft in their queue and clicks Approve or Reject. A 24-hour timeout expires the gate; every decision is recorded with who, what, and when.

4. Resume and stream

   Approve resumes the run within two seconds; the writing step's LLM output streams token by token to the dashboard over Socket.IO. Reject ends the run gracefully.

5. Recover or resume-from-step

   A failed run restarts from its last successful step using stored outputs, so research is not re-executed and tokens are not re-spent.

Key features

Outcome

Conductor runs AI pipelines on Temporal with a deterministic workflow sandbox, idempotent activities, human approval gates that hold no resources while suspended, resume-from-step that never re-spends tokens, and multi-tenancy enforced from the first migration. Two scripted proofs double as sales assets: the kill-the-worker reliability demo and the pause-resume approval demo, both driving the real product API end to end. All planned code units ship; remaining work is operator-gated deployment and design-partner testing.