How it fits
Ironway holds the state that matters — the claim pool, the leases, the pull requests. Conductor notices demand, starts a session, keeps the claim alive, publishes what it built to your forge, and reports honestly.
Ironway decides what to build. Conductor makes sure someone builds it.
Nothing here is roadmap
32 roles ship today
A role is a job the conductor knows how to start a session for. You choose which ones a project may run, and how many may run at once.
Build
Takes a buildable item and delivers it as a pull request.
builder (formerly brakeman) · rework · pr-fixer · issue-fixer · idea-builder · swarm · decompose
Validate
Checks delivered work against its criterion. Never the agent that built it.
validator (formerly judge) · verifier (formerly validate) · reviewer · combination · post-merge · harness-read
Converse
Answers a person, in the place they asked.
shaper (formerly replier) · answerer · directive · assistant (formerly meta)
Curate
Keeps the backlog and the repository honest. Propose-only unless the pill says otherwise.
triager · dedup-scout · idea-scout · security-scout · refactor-scout · doc-scout · fresh-audit · steward · retro
Ship and host lanes
Lands what passed, and says what is waiting on a person.
shipper · merge · sweep · patrol · stationmaster · task-review
Engineered to be trusted
An agent you can leave running.
Autonomy is only worth having if its output is checkable. Four properties do that work, and all four are in the binary rather than in a convention.
-
The protocol is Go; the LLM only builds
Go claims the work, heartbeats the lease, runs the verification, pushes the branch, opens the pull request and attaches it. The session reads the spec, writes the code and tests, and commits.
-
Decides from evidence, never from what a session says it did
Commits ahead of the base, the verify command's exit code, and the push proven with
git ls-remote. A red suite is a fact a session must not be allowed to narrate away. -
Fails closed
Can't read the claim pool → it starts nothing. Lost its lease mid-build → it stops and publishes nothing. The quiet failure is always the safe one.
-
Credentials never sit in the config
Every secret is a reference to a sealed store, and the loader refuses one written inline. The config is never printed — not by the binary, not by its diagnostics.
Install in a minute
One static binary, no cgo — the Go standard library plus four dependencies. Linux and macOS, amd64 and arm64.
curl -fsSL https://ironway.work/install/conductor.sh | shThen conductor init signs you in, offers your reachable projects and runs doctor; conductor serve starts watching. Get started has every step and the published build for every platform.
Or give it a machine of its own
One project, one small cloud server that holds that project's repository and nothing else, made and destroyed with one OpenTofu command. The sessions it runs never see your laptop. Run it in the cloud walks the whole setup, in about half an hour.
Watch it work
The conductor serves its own dashboard on the machine it runs on: what is running right now, the /factory view of the lanes, every past session with full-text search, and the spend. It binds loopback only — conductor tunnel user@host opens a remote host's dashboard in your browser over ssh.