Two planes, one spine, and a human can pause anything.
Pull the picture apart and three things remain: a production plane where agents make things, a control plane where a human watches and gates, and the catalog both of them lean on. Everything else is detail.
The planes, slid apart.
Agents that make things.
Events Calendar · Creative Head · Content Director · Content Creator · QA Agent. Each is a Worker (Agents SDK + Workflows), runs on cron or on a queue, writes artifacts (briefs, shots, assets, scorecards) into the catalog, and speaks to the outside only through the AI Gateway.
agents/* · Workflows · Queues · AI Gateway
The content catalog.
D1 (shots · content_assets · content_embeddings · eval_runs · scorecards) · R2 (masters + variants) · Vectorize (1024-d cosine, embed-v4) · Images (WhatsApp-optimised variants, ThumbHash). The Creator is the sole writer of assets; the Lab owns its derived tables; everyone else reads.
packages/catalog · D1 · R2 · Vectorize
A human watches, gates, pauses.
The console (apps/console) + console-api: RBAC from day one (Cloudflare Access at the perimeter, D1 roles inside, deny-by-default, append-only audit), the Control DO that every agent runs inside (auto ⇄ manual ⇄ paused, kill switch), approvals (briefs, the QA gate), KV config, the open read-only door at demo.namasteji.org.
apps/console · services/console-api · packages/rbac · Control DO
The same picture, with the control plane lit.
Dashed purple = the gate: console → agents. Everything the agents do passes an autonomy check first; a flag in the Control DO stops dispatch without a deploy.
Why it looks like this.
Go deeper
In the repo
- packages/catalog (the spine: D1 schema + R2 keys)
- services/console-api (control plane API, RBAC)
- packages/rbac
- agents/* (production plane)