Orchestration — Causal Operations Atlas

The dashboard Causal Operations Atlas pairs an attention rail (live questions and approvals) with a causal canvas (run cards, DAGs, and Trace Lab) and a docked task drawer. It shows live task state pulled from each connected planner, and action buttons queue commands the planner picks up within a couple of seconds.

How it fits together

A coordinator plans the work and dispatches task contracts over the hosted relay (grpc.nfltr.xyz:443). Connected workers — of different flavors (Claude Code, Codex, Cursor, or a generic MCP backend) — pick up matching contracts and execute each phase inside its own isolated workspace, so one task can never clobber another's files. As work runs, evidence and artifacts flow back through the relay to the coordinator and the dashboard. A human can watch the run live or gate it with an approval before it dispatches.


1. Bring A Fleet Online And Dispatch

Save an API key, then start orchestrating from the CLI or the Atlas causal canvas + Start form. See Fleet Management for connecting workers of different flavors, and Getting Started for the full first-run walkthrough.

nfltr config add-api-key "$NFLTR_API_KEY"   # from dashboard → Settings → API Keys

# Check which workers are connected and what they can run
nfltr orch fleet workers --json

# Dispatch a task contract and watch it to completion (watch is on by default)
nfltr orch start task --task-mode implement \
  --objective "Fix the nil deref in pkg/foo/bar.go reported by TestFoo_NilGuard; return a git patch" \
  --workspace-isolation per_task

Once a worker is connected and a task is dispatched, the causal canvas flips from "Waiting for first update…" to live run cards. If you do not see anything within ten seconds, confirm the worker is actually connected (nfltr orch fleet workers) and that the API key on both sides belongs to the same account. Human gates surface on the attention rail; expand a card for Trace Lab when you want wall-time or critical-path evidence.


2. Launch Your First Task

On the causal canvas Runs surface, click + Start. A small inline form opens:

When you click Start, the Atlas generates a client-side task id (prefixed dash-…) and queues a start_task command. Within ~2s the coordinator picks it up, calls orch.StartTask, and the new task appears on the causal canvas. Click a node to open the docked task drawer. Dispatching from the CLI with nfltr orch start task shows up in the same live view — both paths go through the same coordinator.

Why a client-side id?

So you can queue follow-up commands (approve, answer) targeting the same task before the first digest tick lands. The coordinator uses that exact id when it calls StartTask, so the next command's task_id always resolves.


3. Read The Live View

Tasks group by lineage_root. Top-level tasks render as group headers; child tasks a planner spawned from a parent indent under them. Each row carries:

ElementMeaning
State badgerunning (green), completed (blue), failed (red), pending (amber), waiting (purple, blocked on a question/approval), unknown (gray, no recent digest).
Mode chipThe task contract mode, such as inspect, implement, review, summarize, integrate, or a custom domain mode. Optional actor metadata is shown only as supporting context.
Pulse dotPulses for ~30s after the planner pushed an update for that task. Lets you tell "moving" from "stalled" without watching timestamps.
Relative time"updated 3s ago" — surfaces stuck planners. If the whole group goes quiet for more than 30s the digest is stale and you should check the planner.
Inline alertsPending approval, pending question, and error rows render as colored callouts inside the task they belong to, with the action buttons attached.

4. Steer Mid-Flight

Four controls show up inside task rows when relevant. Each one queues a command at POST /api/v1/orchestration/commands; the planner consumes it within ~2s.

ButtonWhen it appearsWhat the planner does
ApproveTask is paused awaiting dispatch approval (pending_approval=true in the digest).Calls orch.ApproveTask — the task transitions out of approval gate and dispatches.
RejectSame condition as Approve.Calls orch.RejectTask with the reason you typed (defaults to "rejected from dashboard").
AnswerThe worker called ask_question — the digest carries a pending_question.Calls orch.Respond(task_id, your_answer); the worker resumes with your text in the response payload.
AbortAlways available on non-terminal tasks.Calls orch.CancelTask with the reason; in-flight worker calls receive a cancel signal at the next checkpoint.

The same control plane is exposed at the API level if you want to script approvals from CI:

curl -X POST https://nfltr.xyz/api/v1/orchestration/commands \
  -H "X-Api-Key: $NFLTR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"task_id":"dash-abc123…","type":"approve_dispatch"}'

Use Cases

Use case 1 — Repo bug fix from the dashboard

The fastest path to value. Connect a worker against your repo, then click + Start (or run nfltr orch start task) with an objective like "Add a regression test for the bug in #1234 and a minimal patch; return a git patch artifact." The worker turns up in the live view, runs to completion in its own isolated workspace, and returns a git patch artifact you can apply in your own clone:

git -C /path/to/coordinator apply < /path/to/worker/clone/$(jq -r '.result.artifacts[0].path' < result.json)

Deeper walkthrough: Local Repo Improvement with NFLTR Workers.

Use case 2 — Plan → execute → review → integrate

A planner can spawn task-mode contracts under one lineage_root for a multi-actor flow:

  1. The planner decomposes the objective and dispatches one task-mode contract per slice.
  2. As slices complete, the planner dispatches review or verification contracts against returned artifacts.
  3. If the review passes, an integration or fan-in task combines the accepted outputs.
  4. You watch the entire lineage in one collapsible group. Failed reviews show red badges and the failed artifact path; rejecting from the dashboard re-queues the slice with feedback.

Use case 3 — Approval-gated dispatch for risky operations

When you launch a task with the require_approval constraint set in the planner's policy, it parks at pending_approval=true instead of dispatching. The dashboard renders an Approve / Reject alert inline. This is how teams gate deploys, schema migrations, or anything that should not run automatically just because a planner inferred it.

Use case 4 — Mid-flight question and answer

Inside a worker's MCP session, calling ask_question suspends the task with a pending_question. The dashboard shows the question text and a small textarea. Type a one-line answer, click Answer, and the worker resumes. Useful for "Should I prefer option A or B?" decisions you do not want to encode upfront.

Use case 5 — Abort a runaway task

When a worker is stuck in a loop or burning tokens on the wrong objective, Abort is the off switch. The reason you type lands in the orchestrator's history alongside the cancel event so future replays know why the run ended.

Use case 6 — Review a completed task

Terminal-state tasks (completed or failed) get an inline Approve / Request changes / Reject row. Click any of them and the digest row's review_state + reviewer are stamped immediately, with a review event appended to the task timeline. Idempotent — clicking twice converges. Use this when a review loop hands a worker's result back to a human for sign-off.

Use case 7 — Rerun a task

The ↻ Rerun button on terminal tasks dispatches a fresh task with the same objective, worker, task mode, and optional actor metadata, plus a parent_task_id that links it back to the source. The dashboard's plan-tree view nests the rerun under the original so multi-attempt orchestrations stay legible. This is fork-from-N=0: the new task starts clean rather than resuming mid-conversation.

Use case 8 — Per-task workspace isolation

Set --workspace-isolation per_task on the dispatch (or require it as a hard contract) and each task gets a fresh, isolated workspace for the duration of that task, cleaned up on finalization — so one task's edits can never clobber another's files. See Agent Orchestration for the full workspace isolation model.


Behind The Scenes

EndpointDirectionPurpose
POST /api/v1/orchestration/digestplanner → relayPush the planner's current task list (~5s cadence). Stores by authenticated principal.
GET /api/v1/orchestration/tasksdashboard → relayRead tasks scoped to the dashboard user (their planners + sibling agents).
POST /api/v1/orchestration/commandsdashboard → relayEnqueue a command (start_task, approve_dispatch, reject_dispatch, answer_question, abort_task).
GET /api/v1/orchestration/commandsplanner → relayLong-poll for queued commands targeted at this planner (~2s cadence).
POST /api/v1/orchestration/commands/{id}/ackplanner → relayMark a command consumed; the relay drops it from the queue.
POST /api/v1/orchestration/digest/reviewdashboard → relayStamp review_state + reviewer on a digest row. Body: {task_id, action: approve|reject|request_changes|reset, planner_id?}. The relay verifies the row's planner_id is in the principal's owned set.

Dispatch-level safety rails

Flag on nfltr orch start taskEffect
--workspace-isolation per_taskHard contract: the matched worker must give this task its own isolated workspace (a fresh git worktree, cleaned up on finalization) instead of running against a shared checkout.
--require-approvalPark the task at pending_approval until a human approves it from the dashboard or nfltr orch task approve, instead of dispatching immediately.
--require-label, --required-tool, --required-commandHard contracts on the worker's advertised labels, MCP tools, and shell commands — dispatch fails closed instead of matching a worker that can't actually do the work.

Storage is pluggable. The hosted relay at nfltr.xyz uses a SQL store so commands and digests survive a restart. The same wire shape keeps coordinator and worker state consistent across a restart.


Troubleshooting

SymptomLikely causeAction
The causal canvas stays empty after dispatching a task.No worker is connected, or the API key is for a different account.Run nfltr orch fleet workers --json to confirm a worker is connected. Confirm the dashboard email matches the API key's owner under Settings → API Keys.
Pulse dots have stopped, but tasks still show running.The coordinator stopped pushing updates but the task remains in the relay's last snapshot.Check nfltr orch task status --task TASK_ID for the current state. Stale entries time out on the relay side after ~5 minutes.
+ Start reports "Pick a worker first" but the dropdown is empty.No workers are registered under your account, or the worker process exited.Run nfltr orch fleet workers to confirm a worker is online for that API key. The dashboard refreshes the dropdown each time you re-open the form.
Approve / Answer button click toasts "Session expired".Browser session lapsed.Reload the page and re-auth via Google.
Command queued but task did not move.The coordinator consumed the command but the orchestrator rejected it (e.g., task already terminal).Run nfltr orch task events --task TASK_ID --tail 20 to see the rejection reason on the task timeline.
Review button toasts "task not found within owned planners".The dashboard session belongs to a different account than the one that dispatched the task, or the digest row TTL'd out.Confirm the dashboard email matches the dispatching API key under Settings → API Keys. Terminal-state rows survive 7 days; live rows time out after 5 minutes of no refresh.
An isolated task workspace from a crashed prior task blocks a rerun.The worker exited before it could run its workspace cleanup.The next task with the same id reuses the path after a clean teardown. Contact the worker owner if the stale workspace needs a manual evict.

Next