A murmuration of birds in plum, teal and sand, gathering into one turning arc.

Choreograph

Human-AI coordination at scale.

FOR AI & PLATFORM TEAMS BUILDING HIGH-STAKES WORKFLOWS

Put agents to work in real operations. Choreograph is the 100% open-source workflow runtime that brings in human judgment where it matters and keeps work moving through approvals, exceptions and changing conditions. Every decision leaves a record your auditor can independently verify.

Bring us a workflow Watch the film

Agents are swappable. Guarantees are not.

Figure 1The film.

Film guide and transcript

Hard guarantees — the rules are the envelope
Human oversight — the human is on the controls
Tamper‑resistant record — every decision is recorded
Replayable by an auditor — your auditor re‑runs it, not us

Nobody thinks twice about boarding a plane. That isn’t luck. It’s governance. A checklist that can’t be skipped. Autopilot that flies inside limits it cannot cross. A human who can take the controls in an instant. And a recorder that captures every second. Safety got us off the ground. Proof made it a commodity: regulated, insured, sold by the seat, at scale.

Now we’re handing real work to AI. Approving invoices. Moving money. Deciding credit terms. But when someone asks why, there’s mostly a log. Written by the same system that made the call.

Choreograph is the audit‑grade airline cockpit for AI work. Designed to the EU AI Act, by construction. The process is the checklist. The rules are the envelope. The human is on the controls. Every decision is recorded. We corrupted it. Hijacked it. Crashed it mid‑payment. The structure won. Here’s the receipt. Your auditor re‑runs it, not us.

This is where it goes. An open standard for insuring AI agents. Humans and agents coordinating at scale. AI work, as ordinary as a boarding pass. Agents are swappable. Guarantees are not. Choreograph. Delegation you can prove.

What is Choreograph

Choreograph coordinates agents, people and systems around one shared task. The airline example below shows the pattern: the task carries the state, rules, authority and history; the right actor steps in when needed. Your agents and applications stay in place.

Illustrative trip recovery: an AI agent finds a replacement itinerary, the support lead approves a non-partner airline exception, and the passenger accepts. The teal Choreograph Trip Recovery Task carries state, rules & safeguards, authority, history & observability, orchestration, events, data, instructions and tooling in three rows of three cards, connected to booking, baggage and payment systems. — Figure 2An illustrative trip-recovery workflow: one task, the right actor at each step.

Governance. The AI can find the replacement. Only the authorised support lead can approve the non-partner airline exception.

Coordination. The same task carries the work from AI agent to support lead to passenger, while booking, baggage and payment systems stay connected underneath.

Why we created it

An agent can do its job and still leave the workflow broken. When rules, context and handoffs are scattered across tools, your team becomes the glue.

Agent-centric work spreads states, rules, approvals and history across separate systems. Choreograph puts business states, rules, instructions and history in one executable task shared by humans and agents. — Figure 3One shared workflow for people and agents.

Today: no shared task object. The workflow is fragmented and rules are difficult to enforce. State drifts, records fragment and handoffs break across separate systems. — Figure 3One shared workflow for people and agents.

Put the competence in the task. The rules, context and history stay with the work, whoever picks it up next.

Principle 01

Many minds. One shared workflow.

Change the worker. Keep the workflow. Agents handle routine steps; people bring judgment and authority. Instructions, context and history stay with the task, so the next participant picks up where the last left off.

Concept illustration: humans provide judgement, context and approvals; agents are recruited per task step. The invoice carries instructions, rules, tools, skills, data and replayable history, with finance-lead sign-off before payment. — Figure 4Shared work, shared context.

See the whole operation.

Track invoices. Follow related tasks. Inspect the decisions behind them. One board brings the work together.

Open the full-board still

Full Choreograph invoice board: tasks across workflow states, selected invoice detail, child tasks, effects and recorded history. — Figure 5The whole workflow in view.

Still from the accounts-payable demonstration; bank effects are sandbox drafts.

Declare the workflow once, in Python.

Define states, permissions, instructions and dependencies in Python. Swap the worker without rewriting the process. State and history persist in PostgreSQL.

Read the full task type declaration

SDK surface shown as intended for the release; names may change.

Principle 02

Nothing can be bullshitted.

Saying ‘approved’ does not make it approved. The actor needs authority. The change must pass the declared checks. Otherwise, it does not commit.

Four guarantees you can build on.

Hard guarantees
An instruction hidden in a document cannot redirect a payment.
The payment’s recipient must match the approved record.
Figure 6Payee protected.
Human oversight
Keep consequential decisions with the people accountable for them.
The proposed action waits until a distinct human approves it.
Figure 7Human approval.
Tamper-resistant record
Find out when someone has changed the history.
An independent verifier checks the record and identifies the changed commit.
The 20-second product loop shows this check in action.
The recorded history changes; verification identifies the changed commit.
Watch the product loop
Replayable by an auditor
Give an auditor evidence they can examine without taking your word for it.
The record, rules and evidence bundle can be checked by a third party.
Figure 8Independent evidence.

Bank effects in the demonstrations are sandbox drafts. Real money stays behind an engineering gate.

Artwork: European Edtech Alliance

The rulebook arrived.

The EU AI Act makes it law: high-risk AI systems must keep automatic, tamper-resistant records and keep a human in command. Choreograph was designed to those obligations.

Art. 12 · 14 · 15. Choreograph is a component; compliance remains the deployer’s.

The Act, article by article

Principle 03

Every action. On the record.

Follow every decision back to the evidence. See who acted, what changed and what was refused. Reconstruct earlier states and verify the history independently.

Change one byte. The verifier names the changed commit.

Figure 9Tamper detected.

Try to rewrite history.

invoice #4218 · Acme Produce · illustrative

awaiting record · 0 commits

Commit	Hash	At	Actor	Edge	Amount	Memo
genesis	…					the record needs JavaScript to verify itself; the rows are hashed client‑side.

Figure 10Try the record.

human · agent · system. Hover a hash for the full SHA‑256. Amounts and memos are editable.

Interrogate the record. Not the chatbot.

Query actions, approvals, refusals and receipts with ordinary SQL. Reconstruct earlier states and verify the chain with the CLI.

Three SQL queries. Two CLI commands. Recorded examples, with no live database connection.

Explore the SQL and audit commands

Invoice history Effects & receipts Refused actions Verify the chain World at a commit

Invoice history

SELECT at, actor, action, state
FROM invoice_history
WHERE invoice = 4218 ORDER BY at;

SQL · architect-reviewed example; illustrative invoice ID

Read the invoice’s history in time order. This architect-reviewed query uses an illustrative invoice ID; an exact result capture is not included.

See related history in the demo

Effects & receipts

SELECT operation, status, count(*)
FROM effect
GROUP BY operation, status ORDER BY operation;

SQL · recorded at 06:40

operation            | status    | count
create_bill          | CONFIRMED | 1
create_payment_draft | CONFIRMED | 2
(2 rows)

See a recorded effect’s arguments and receipt

{"vendor_id":"VEND-HRL","line_items":[{"rate":1250,"item_id":"ITEM-004","quantity":20},{"rate":1200,"item_id":"ITEM-001","quantity":25}]}

{"status":"open","bill_id":"mockbill-1","reference_number":"CG:f0b0537f6fc511a8"}

Mock-backed Zoho bill from the recording; bank drafts are sandbox.

Refused actions

SELECT to_char(ts,'HH24:MI:SS') AS at,
  author->>'spec_name' AS who,
  rejection_reason AS refused,
  action->'attempted'->>'from' || ' -> ' ||
  (action->'attempted'->>'to') AS attempted
FROM "commit" WHERE rejected ORDER BY ts;

SQL · recorded at 01:58

at       | who          | refused       | attempted
12:32:30 | finance-lead | INPUT_INVALID | open -> approved
(1 row)

Verify the chain

choreograph verify

CLI · recorded at 07:20

verify: FAILED (branches=1, commits=520)

# after restoration, the command is run again
verify: OK (branches=1, commits=520)

World at a commit

choreograph world-at <commit> --task <id>

CLI · read-only reconstruction

Reconstruct the committed world at a decision. Substitute a commit and task from your record. No result capture is included for this command.

Figure 11Inspect the evidence.

Towards an open standard for agent insurance.

Insure AI work on evidence, not assurances. The ambition is an open standard that lets an insurer assess an agent deployment from a record it can independently verify.

Today, Choreograph produces an evidence bundle and an insurability score. These expose the controls and gaps; they are not insurance cover or certification.

The framework, record format and verifier open with the repository. Underwriting services remain a future ambition.

The insurability score from the recorded demo. — Figure 12A basis for insurance.

Give us your workflow

Bring us a workflow your team still has to hold together. Let’s put agents to work, with people in control.

Discuss a pilot