TealFlow

# .tealtiger/workflows/production.yaml
name: production-governance
version: "1.0.0"
description: "Production governance workflow for customer-facing agents"

# Inherit from org-level workflow
inherits: org://default-governance

# Environment binding
environment: production

# Workflow jobs (executed in dependency order)
jobs:
  identity-check:
    module: nhi-governance
    config:
      enforceAttestation: true
      enforceScopes: true
    on_failure: deny

  content-classification:
    module: teal-classifier
    config:
      mode: ensemble_union
      confidence_threshold: 0.7
    on_failure: deny

  secret-detection:
    module: teal-secrets
    config:
      enabled: true
      patterns: [aws, gcp, azure, github, generic]
    depends_on: [content-classification]
    on_failure: deny

  drift-detection:
    module: teal-drift
    config:
      enabled: true
      sensitivity: medium
    depends_on: [identity-check]
    on_failure: monitor

  cost-governance:
    module: teal-monitor
    config:
      daily_limit_usd: 100
      per_request_limit_usd: 5
      anomaly_detection: true
    depends_on: [identity-check]
    on_failure: deny

  evidence-emission:
    module: teal-proof
    config:
      receipts: true
      passport: true
    depends_on: [secret-detection, drift-detection, cost-governance]
    on_failure: monitor
    run: always  # Run even if upstream jobs deny

import { TealFlow } from 'tealtiger/flow';

// Load workflow from YAML
const flow = await TealFlow.fromFile('.tealtiger/workflows/production.yaml');

// Or from string
const flow = TealFlow.parse(yamlString);

// Validate workflow (checks module references, dependency cycles, etc.)
const validation = flow.validate();
if (!validation.valid) {
  console.error('Workflow errors:', validation.errors);
}

// Execute workflow against a request
const result = await flow.execute(request, ctx);

console.log(result.decision);       // Final merged decision
console.log(result.jobResults);     // Per-job results
console.log(result.executionOrder); // Actual execution order
console.log(result.duration_ms);    // Total execution time

interface FlowExecutionResult {
  /** Final governance decision (merged from all jobs) */
  decision: Decision;

  /** Per-job results */
  jobResults: Record<string, JobResult>;

  /** Actual execution order (respecting dependencies) */
  executionOrder: string[];

  /** Total execution time */
  duration_ms: number;

  /** Workflow version that was executed */
  workflowVersion: string;

  /** Inheritance chain */
  inheritanceChain: string[];
}

interface JobResult {
  /** Job name */
  name: string;

  /** Job status */
  status: 'success' | 'failed' | 'skipped' | 'denied';

  /** Decision from this job */
  decision?: Decision;

  /** Error if failed */
  error?: string;

  /** Execution time for this job */
  duration_ms: number;
}

jobs:
  A:
    module: teal-classifier
    # No dependencies — runs first

  B:
    module: teal-secrets
    depends_on: [A]  # Runs after A

  C:
    module: teal-drift
    depends_on: [A]  # Runs after A (parallel with B)

  D:
    module: teal-proof
    depends_on: [B, C]  # Runs after both B and C

Time →
  A ─────┐
         ├── B ────┐
         │         ├── D
         └── C ────┘

# org://default-governance (set by platform team)
name: org-default-governance
version: "2.0.0"
description: "Organization-wide governance floor"

floor: true  # This workflow sets the governance floor

jobs:
  identity-check:
    module: nhi-governance
    config:
      enforceAttestation: true
    on_failure: deny
    floor: true  # Cannot be weakened by child workflows

  secret-detection:
    module: teal-secrets
    config:
      enabled: true
      confidence_threshold: 0.8
    on_failure: deny
    floor: true

  audit-evidence:
    module: teal-proof
    config:
      receipts: true
    on_failure: monitor
    floor: true

# Team-level workflow
name: team-ml-governance
inherits: org://default-governance

jobs:
  # Inherited jobs (identity-check, secret-detection, audit-evidence)
  # are automatically included and cannot be removed

  # Team adds additional governance
  model-registry:
    module: teal-registry
    config:
      allowlist: [gpt-4o, claude-3.5-sonnet]
    depends_on: [identity-check]

  cost-limits:
    module: teal-monitor
    config:
      daily_limit_usd: 50

// Attempting to weaken a floor job throws FloorViolationError
const flow = TealFlow.parse(`
name: team-workflow
inherits: org://default-governance

jobs:
  secret-detection:
    module: teal-secrets
    config:
      enabled: false  # ← Attempting to disable a floor job
`);

const validation = flow.validate();
// validation.valid === false
// validation.errors === [
//   { type: 'FLOOR_VIOLATION', job: 'secret-detection',
//     message: 'Cannot weaken floor job: secret-detection.config.enabled cannot be set to false' }
// ]

jobs:
  pii-scan:
    module: teal-classifier
    config:
      categories: [pii]
    condition:
      # Only run for customer-facing agents
      agent_classification: customer-facing

  high-value-approval:
    module: approval-gate
    config:
      approvers: [[email protected]]
    condition:
      # Only require approval for high-value actions
      estimated_cost_usd: { gt: 100 }
    depends_on: [pii-scan]

import { TealFlow, WorkflowBuilder } from 'tealtiger/flow';

// Build workflows programmatically
const workflow = new WorkflowBuilder('my-workflow')
  .version('1.0.0')
  .inherits('org://default-governance')
  .environment('production')
  .addJob('classifier', {
    module: 'teal-classifier',
    config: { mode: 'ensemble_union' },
    onFailure: 'deny'
  })
  .addJob('drift', {
    module: 'teal-drift',
    config: { sensitivity: 'high' },
    dependsOn: ['classifier'],
    onFailure: 'monitor'
  })
  .build();

// Export to YAML
const yaml = workflow.toYAML();

// Execute
const result = await workflow.execute(request, ctx);

const flow = await TealFlow.fromFile('workflow.yaml');
const validation = flow.validate();

// Validation checks:
// - All referenced modules exist
// - No circular dependencies
// - Floor constraints respected
// - Config schemas valid for each module
// - Environment bindings valid
// - Version compatibility

if (!validation.valid) {
  for (const error of validation.errors) {
    console.error(`[${error.type}] ${error.job}: ${error.message}`);
  }
}

import { TealEngine, TealFlow } from 'tealtiger';

const engine = new TealEngine({
  workflow: await TealFlow.fromFile('.tealtiger/workflows/production.yaml'),
  // Modules are resolved from the workflow definition
  // Policy is derived from workflow job configs
});

// evaluate() now executes the workflow
const decision = await engine.evaluate(request, ctx);