07/04/2026
Most "agentic AI" systems are demos wearing production clothing.
They look impressive until something goes wrong — and then you discover the agent made a decision you can't trace, mutated state you can't roll back, and logged nothing you can audit.
We built something different.
Flowstack OS is a bounded automation control plane. Its job is to deploy, operate, and repair workflow systems — without handing authority to the model.
The architecture is deliberately layered. A Node.js control plane holds the source of truth. n8n runs workflows but owns no logic. LiteLLM and local models handle bounded reasoning tasks — classification, summarization, remediation drafts — but their output is never the final word. Every change travels through deterministic review gates, approval paths, and post-apply validation before anything touches a running system. Tenant state, code, and workspace are physically separated. Ledgers are replay-safe. The repair loop is supervised, not autonomous.
The local-agent subsystem follows the same discipline. Known failure classes are classified deterministically — the model is consulted only where the answer is genuinely ambiguous, and its response is constrained, structured, and guarded before it reaches any operator surface. There is no freeform orchestration. There is no uncontrolled shell ex*****on. The agent produces artifacts and signals; the control plane decides what happens next.
This is the part most AI automation systems get backwards.
They start with "the agent does X" and then bolt on guardrails later, usually after something breaks in production. We started from the opposite direction: what does a deterministic, auditable, operator-first control system look like, and where — precisely — can a model add value without becoming a liability?
The answer turns out to be a narrow but useful slice: bounded summarization, bounded planning, constrained diff drafting, operator note generation. Everything else stays deterministic.
The constraints are not limitations we tolerated. They are the design.
A system that cannot mutate production autonomously, cannot bypass the approval gate, cannot generate diffs without a passing review, and cannot classify a known failure class incorrectly — is not a weaker system. It is a system you can actually run in production, hand to an operator, and trust the output of.
Most AI automation collapses the distance between "model said so" and "system did it." We kept that distance deliberately large, and built infrastructure to manage it precisely.
That is what production-grade looks like.
