Introducing Cordum

Why now: Autonomous workflows are already touching production, but most teams do not have a reliable way to govern them. The risk is not the model; the risk is uncontrolled execution. That is the gap Cordum closes.

Why we built Cordum

Operations teams are moving faster than ever, and autonomous workflows are already automating work that used to require a human. But most of these workflows are held together by scripts and ad-hoc approvals that do not scale.

Cordum is built for a single purpose: make autonomous workflows safe and auditable without slowing the safe path. We want teams to ship autonomy to production without losing control.

What it is

Cordum is a deterministic control plane for autonomous workflows. It runs on NATS for the bus and Redis for state, with a Safety Kernel that evaluates every job before dispatch, and a workflow engine that orchestrates runs, approvals, and retries.

The core is intentionally boring: schedules, state, approvals, and audit trail. Domain logic lives in packs, not in the core.

Safety Kernel

The Safety Kernel is the policy decision point. It returns ALLOW, DENY, REQUIRE_APPROVAL, or ALLOW_WITH_CONSTRAINTS. Decisions are bound to a policy snapshot and recorded with a reason.

Approvals are explicit and tied to the exact job hash. Constraints keep risky actions within safe bounds like max runtime, diff size, or network egress allowlists.

Workflow Engine

Workflows are explicit DAGs. Runs emit a timeline of step states, approvals, and results. The engine can pause, retry, or resume a run without losing context.

workflow.yaml

name: incident-triage
steps:
  triage:
    type: worker
    topic: job.incident.enrich
    
  approval:
    type: approval
    depends_on: [triage]
    reason: "Review before remediation"
    
  remediate:
    type: worker
    topic: job.incident.remediate
    depends_on: [approval]
    constraints:
      max_lines_changed: 500
      max_runtime_sec: 900

Packs

Packs are how domain logic ships. Packs install workflow definitions, schemas, and policy overlays. Install does not execute code; you deploy workers separately on your own schedule.

This keeps the core stable while letting teams iterate on domain logic quickly. It is safe to upgrade core without rewiring every workflow.

Source-available by default

Cordum is source-available so you can inspect the control plane before it touches production. You can run and modify it for internal use. Hosted or resale use cases require a commercial agreement.

See /legal/license for full terms.