ExecWarden Docs

Automation

Build repeatable agent workflows from requests, schedules, and events.

Design a saved graph directly, combine deterministic and agent steps, and keep scoped capabilities and approvals intact across manual, scheduled, and event-started runs.

Workflow Model

Use a workflow when the work should run again from a manual request, schedule, or event. You can design it directly as a persisted graph of explicit steps and branches. Each run saves progress between steps and keeps the definition and access-policy snapshot it started with.

JavaScript stepRun bounded deterministic logic for validation, transformation, routing, and short capability calls.
Agent stepStart open-ended agent work, persist its run id, and poll it from a later resumed step.
Durable pauseReturn a timer wait or human-input request instead of keeping JavaScript or an agent process alive.
ApprovalA sensitive capability call can pause independently with its exact arguments; approval does not grant the whole workflow broader authority.

How Runs Start

A trigger creates a run and stores its input as run context. The graph itself stays the same regardless of whether a person, a clock, or another system supplied that input.

Manual or scheduleStart with operator-supplied input, or run on a five-field cron schedule with an optional timezone.
GitHubSupported GitHub and GitHub App events can publish repository context directly into a matching workflow trigger.
SlackA configured Slack Events API receiver verifies messages and app mentions, then publishes slack.message or slack.mention.
Other systemsUse a signed webhook receiver or declared package event for incident tools, CRMs, and internal applications.

Agent Touchpoints

One Agent identity can respond from several systems while inbound context and outbound authority remain separate. Slack makes the pattern concrete:

MentionSlack sends a signed app_mention; ExecWarden verifies it and publishes slack.mention with channel, user, message, timestamp, and team context.
RunA matching workflow starts the same named Agent with that event context. JavaScript steps can route first, and the run may wait for the agent or a person.
ReplyThe Slack package can read recent history and post only in configured allowlisted channels. chat.post_message is a separate action and can require approval.
EvidenceThe event delivery, workflow run, linked agent work, approval decision, provider result, and activity record remain inspectable as separate facts.

See the Saved Workflow

The console keeps the graph, exact trigger source and event type, and tool scopes visible before you start another run.

Incident response workflow with three connected steps, an incident.created trigger, and repository-scoped tools
This public-safe fixture uses a custom incident receiver, a three-step graph, and three repository-scoped tools, including one write that requires approval.

What a Workflow Stores

WorkflowThe saved job: name, definition, enabled state, outputs, and access rules.
TriggerWhat starts it. Manual, schedule, GitHub webhook/GitHub App events, configured Slack message and mention events, custom webhook receiver events, and declared package events work today; richer trigger discovery and setup UI are follow-up work.
RunOne execution: status, trigger input snapshot, definition/policy snapshot, logs, approvals, artifacts, and linked session if an agent was started.
Access rulesWhich tools are unavailable, allowed, or require approval for the workflow.

Create One From a Prompt

Open the Workflows page, describe the job and how it should start, and start the workflow-building agent. ExecWarden opens that agent with workflow admin capability and asks it to call workflow:validate before workflow:create or workflow:update. If the request is ready, the agent saves the workflow and links back to it; if credentials, package setup, or policy details are missing, it should draft the shape and explain what to review before the workflow is runnable. Open the saved workflow from the returned link or the Workflows page to inspect its definition, run it, and review the run evidence.

Advanced fallback: start a generic agent session, open Configure capabilities, enable Workflow authoring with Admin access, then ask for the workflow you want. That manual route uses the same workflow management functions, but the Workflows-page authoring panel is the primary entry point.

Create a manual workflow named Echo input. It should accept a JSON object, return it with an ok flag, and be enabled so I can run it from the Workflows page. Create a manual workflow that starts an agent to inspect my repo status, summarize open risks, and ask before making any GitHub write. Create a scheduled workflow named Daily readiness check. It should run every weekday at 09:00 Europe/Brussels time, inspect a JSON input trigger object, and return a concise ok/status result. Create a graph workflow with a JS step that checks a condition from input. If it is not ready, return a durable wait for 60 seconds; otherwise finish with a ready result. Create a workflow that subscribes to the existing webhook:incident-router receiver's incident.created event and starts an investigation agent with the event payload.

For webhooks, set up the receiver first from the Webhooks page or a webhook-capable agent, then create a workflow that subscribes to the receiver's emitted events. Webhook handlers publish workflow events; workflows do not subscribe to raw HTTP requests. See Webhook Events for the receiver and handler shape.

Example Workflow Shapes

Keep PRs current

A manual workflow run starts an agent that rebases branches, runs tests, and shows the branch update before pushing within the branch policy.

Fix red builds

A manual or GitHub/custom webhook event-triggered workflow starts an investigation with repo and CI context.

Poll remote readiness

A JS step checks an external condition, returns a durable wait when it is not ready, then resumes later without keeping a process alive.

Review comments loop

A manually run workflow reads review comments, proposes edits, and asks before writing.

Nightly report

A scheduled workflow produces a report artifact without write authority, with one run per scheduled slot.

Need an external event to start it?Use Webhook Events to verify and normalize the provider callback before the workflow runs.
Need a package action in the run?Use Capability Packages and grant only the package actions this workflow needs.
Need to review writes?Use Approvals & Policy for exact-call review before risky workflow actions execute.
Need runtime details?Use the Workflow Runtime reference for recovery, idempotency, waits, hosted-agent polling, and branch semantics.