The split
One build, two actors. Nothing in the left column is delegated to a model, and nothing in the right column is trusted without evidence.
| What Go does | What the session does |
|---|---|
| Registers the host, reads the claim pool, decides there is work. | Reads the criterion, the PRD and the previous attempts' handoffs. |
| Claims one item and heartbeats its lease on a timer. | Writes the code and the test that pins it. |
| Prepares an isolated worktree on a branch off the served base. | Commits on that branch, and only there. |
| Runs the verify command and keeps its exit code. | Fixes what the verify run found — it may not weaken it. |
| Pushes, opens the pull request, attaches it to the PRD. | Writes a result file: what it built, what it did not, what is blocked. |
| Completes the item, or releases it with the session's handoff. | Exits. It never completes, releases or merges anything. |
Evidence, not narration
A session's account of its own work is the last thing the conductor believes. What it reads instead: commits ahead of the base, the verify command's exit code, and the push proven against the remote with git ls-remote. A red suite is a fact a session must not be allowed to narrate away — so a build that did not verify is handed back with the failure attached, not published with a confident summary.
Every session is a record
Each run writes sessions/YYYY/MM/<id>/ — an events.jsonl of what the supervisor decided and when, the full transcript, and the session's output. They are catalogued with full-text search, so "what happened on that bead three weeks ago" is a query and not an archaeology project.
Spend and governance
Per-role daily spend and action caps, enforced before a session starts rather than apologised for after. Sessions are spawned on demand and the fleet drains to zero. A 60-second check-in lets Ironway register this host, tune its roles and caps, pause it and upgrade it — so a fleet is governed from one place instead of by logging into machines.
Never writes to the default branch
Work lands as a pull request. The merge lane puts reviewed, green requests onto an integration branch, and promotion to the release branch is its own request — so nothing an agent did arrives on your default branch without a merge somebody can see.
Model-agnostic launchers, pooled accounts
claude -p by default; opencode run and codex exec are configured the same way. A fallback launcher covers an outage, and a stronger model can be held back for a bead's last attempt rather than spent on its first. With TeamClaude, sessions run across several Claude accounts and move to the next as one runs low; while none can serve, the conductor starts nothing rather than starting sessions that will fail.
The dashboard
conductor dashboard serves /, /factory, /wallboard, /sessions, /stats and /docs, bound to loopback — on :8095 on a laptop and :18095 on a cloud host. conductor tunnel user@host opens a remote one in your browser over ssh rather than by exposing it.