Runtime Orchestration and State Machines
Approving a WorkOrder does not execute it. Between authorization and a review ready result lies a distributed process that may run for minutes or hours, cross process and provider boundaries, survive restarts, wait for human decisions, and
A focused view of boundaries, contracts, state, authority, failure paths, and tradeoffs drawn from this chapter.
Reconstruct and defend this chapter’s architecture.
Reconstruct the architecture, name each boundary, and defend the tradeoffs.
Open the source exercise
Draw dispatch through completion with Convex, Hono, an executor, a worktree, GitHub, and CI. Add a process crash after GitHub accepts a PR creation request but before Mission Control records the response. Show the idempotency key, provider reconciliation, and authoritative records that prevent a duplicate PR.
4. Tradeoffs and alternatives
A database-driven orchestrator is simple and observable but can create polling load and contention. A queue improves delivery and backpressure but adds another operational system. A workflow engine offers durable timers and retries but can duplicate domain state if it becomes the business source of truth.
Event sourcing provides excellent history but increases projection and schema complexity. Mission Control uses durable records plus append-only event streams, a pragmatic middle ground. The important choice is not the brand of queue or engine; it is the location of authority and the invariants around transition.
Parallelism reduces lead time but increases conflicts, cost, and coordination. Concurrency should be bounded by dependency graphs, repository isolation, budget, and merge strategy rather than maximized by default.
5. Current Mission Control Implementation
This assessment uses commit
b31e27564deb1c03c167e61b5ee094567c2ba7b1,
studied on 2026-08-09.
Mission Control’s accepted orchestration decision places durable state in Convex and long-running coordination in a Hono/Node process. The orchestration server uses a Convex client, exposes protected operational routes, runs a coordinator tick, and hosts executor adapters. It must not become an independent state store.
Workflow definitions compile into linear or DAG graphs. The graph layer validates duplicate IDs, unknown dependencies, self-dependencies, cycles, conditions, output contracts, and bounded concurrency. WorkflowRuns retain a snapshot, steps, current step, status, retry counts, timestamps, and links to WorkOrders and Tasks.
Run events have sequence numbers and stable types for starts, steps, tools, commands, files, artifacts, checkpoints, retries, human intervention, pause, resume, failure, and completion. Events and artifacts accept idempotency keys. Terminal failure or cancellation reconciles unfinished steps into failed, blocked, or skipped states instead of leaving optimistic work behind.
The codex/v1 adapter contract is narrower than the orchestration server. It
executes an already-authorized Attempt, validates repository and path scope,
emits ordered events, supports cancellation, and does not claim resumability.
It cannot approve, accept, merge, release, or widen authority.
The committed system is nevertheless incomplete at the real factory boundary. The generic coordinator contains older task-decomposition behavior, and the complete leased worker that turns a Factory-dispatched Attempt into an isolated worktree, Codex execution, GitHub branch, exact-lineage PR, and restart-safe completion remains part of uncommitted todo-024 work. The retained golden-path lab therefore stopped before execution.
Review this chapter.
Challenge a claim, boundary, missing failure mode, unclear term, or unsupported evidence statement.
- Claim
- Boundary
- Failure
- Evidence