orchestrate-workflow

Orchestrate a governed multi-agent workflow

Use when you want the Bun-in-Rust shape — an implementer writes, independent adversarial reviewers attack the diff, a fixer applies feedback — with each agent's capabilities, model, and secrets managed by agentstack instead of hand-assembled per run.

The division of labor is fixed: an executor runs the loop (sandcastle, Claude Code workflows, your own script); agentstack defines and provisions the agents the loop spawns. Don't blur it in either direction.

1 — Define roles as profiles

A role is a profile: which skills, which servers, and (by convention) which model. In .agentstack/agentstack.toml:

[profiles.implementer]
skills  = ["porting-guide"]        # the task's context artifacts
servers = ["github"]

[profiles.reviewer]
skills  = ["adversarial-review"]   # ships in this catalog
servers = []                       # reviewers judge the diff; no tools needed

Keep reviewer profiles minimal on purpose — a reviewer with no servers can't be tool-poisoned, and the diff is all it should trust anyway.

2 — Bind models to roles

Pick per role, not per run: bulk/mechanical implementation → a cheap strong coder; review → a different model family than the implementer when possible (diverse failure modes). Record the binding wherever the executor configures each agent (sandcastle's agent: option, a Workflow model: param, a --model flag). If the route-by-cost skill is loaded, apply its ladder.

3 — Provision the sandbox (works today, no extra tooling)

The box needs three things: the harness CLIs, the rendered capabilities, and secrets that never touch disk.

# on the host — render the role's capabilities into the worktree the
# sandbox will mount (repeat per worktree):
cd <worktree> && agentstack use implementer --write

# start the container with secrets injected from the keychain at run time —
# no .env file, nothing baked into the image or committed:
docker run \
  -e GH_PAT="$(agentstack secret get GH_PAT)" \
  -e ANTHROPIC_API_KEY="$(agentstack secret get ANTHROPIC_API_KEY)" \
  -v <worktree>:/work ...