Borz Flow.
Programmable, governed control flow for a supervised agent fleet.
Work moves through declared edges — A to B to C, looping until a condition holds, pausing at an approval gate before anything irreversible. A typed manifest is the authority; the flow program is an untrusted driver that only addresses declared edges by index. The control plane — not the program — enforces the graph, the loop budgets, and the gates.
Typed members and edges, quorum / human / policy gates, and budgeted loops — every loop declares a budget (iterations, tokens, or wall-clock) with an exhaustion action; an unbudgeted cycle is rejected by the control plane before the flow runs. Strict validation: unknown manifest keys are errors, not warnings.
Only a positive assertion from the dispatched agent completes a step. Supervision machinery and timeouts can fail a step, but they can never synthesize a success — a wrong failure costs a re-run; a wrong success would corrupt the record, so the contract forbids it.
Each edge traversal appends a structured entry to the run journal — a recorded decision path against the manifest that produced it.
All five contract host functions — dispatch, await, gate, audit annotation, and read-only state query — are implemented with tests in Clan Control's engine, under the same deny-by-default sandbox discipline already shipped elsewhere in the portfolio.
Today, flows are authored as a declared manifest, validated when the flow loads. A dedicated language construct for authoring flows in Borz — checked ahead of time by the compiler rather than validated at load — is on the roadmap, gated on evidence from production use of the manifest tier. We're not publishing syntax for it yet: it isn't decided, and printing it here would turn a design direction into an expectation.
Traversal records are recorded today. Cryptographic signing of the audit chain is designed, not shipped — until it ships, we say "recorded," not "signed" or "tamper-evident."
Claims on this page last verified 2026-08-11.