Building Jardinero: a control plane for autonomous engineering agents.
It's a TypeScript orchestrator living in a long-lived
@TenkiCloud sandbox. Three workflows so far.
1) The Log Reviewer runs hourly and post-deploy. It sweeps staging and prod through the Grafana MCP, investigates anomalies, and writes a structured handoff: suspected root cause, reproduction steps, acceptance criteria, suggested tests, etc. The handoff is the only thing it produces. It never touches code.
2) The Implementator picks up that handoff. The orchestrator claims it (fingerprinted, idempotent, so two log reviews of the same incident cannot dispatch twice), spins up a fresh worker sandbox, hands the handoff to Codex inside it, and the agent opens the PR.
3) The PR Maintainer listens for review-comment events piped in from GitHub Actions. The orchestrator dedupes the event, dispatches an ephemeral worker sandbox with Codex inside, and the agent pushes fixes, replies to reviewers, and gets CI green.
Agents are stateless. The control plane is not. Every task gets a fresh microVM, no mutable state shared between runs. Persistence is a five-table SQLite file on the orchestrator's volume.
The orchestrator does not trust the worker. When the agent reports a PR URL, the orchestrator independently fetches it, checks the repo scope, the branch name, and an Agent-Run-Id commit trailer before marking the run successful.
Blast radius is contained by the repo, not the agent. Branch protection, required CI, and human reviewers are the safety net. The agent is unsupervised at the action boundary on purpose.
Cold-start is cheap because Tenki templates pre-bake the toolchain and volumes hold warm git mirrors. A worker spins up in ms, clones from cache, runs codex exec, opens the PR, then the microVM dies.
One orchestrator, N ephemeral workers, a durable queue, a Discord webhook.