The Workflow Engine · 05.03
The SWIFT Lifecycle: Scope, Workflow, Iterate, Formalize, Truth
The five-stage discipline behind every hardened workflow, from declaring how success will be verified to a verdict engine that never trusts a self-report.
Five letters, five real stages, each with its own tool
SWIFT isn't a slogan — it's five concrete stages a workflow actually passes through, each backed by a real tool call and a real check, not just a naming convention:
| Letter | Stage | The real mechanism |
|---|---|---|
| S | Scope | agentis.workflow.scope persists the spec — the objective and its acceptance checks — before the graph is even fully built. The question "how will we know this worked?" is asked first, not bolted on after. |
| W | Workflow | The graph itself gets authored under a robustness-audited discipline — deterministic-first rules and anti-fabrication checks applied as the graph is built, not just reviewed afterward. |
| I | Iterate | agentis.workflow.test manages and runs a pinned suite of test cases through the free dry-run engine, stamping hash-keyed evidence. Generated cases are never allowed to gate on their own — a human or an existing pinned case has to back them. |
| F | Formalize | agentis.workflow.harden is the hardening gate: it refuses outright until every SWIFT predicate holds at the workflow's current graph hash — including a debug run whose verdict is genuinely accomplished, not merely completed — then freezes the graph's exported form. |
| T | Truth | The verdict engine — after any run settles, it probes the real world and computes accomplished, partial, hollow, or failed_checks, and keeps rolling a production accomplishment health metric afterward that can flag a regression even on a workflow that was already hardened. |
Hardening is what an unattended trigger has to earn
Hardening isn't a courtesy checkbox — it produces a proven revision that other systems can trust. An unattended trigger is blocked from arming unless the workflow's active revision is proven. Saving or importing a change creates a candidate and leaves the active production revision in place; the candidate must be verified and promoted before an unattended trigger can use it. An audited override is available for an exceptional operator-directed deployment. See Operating Workflow Revisions for the promotion procedure and Triggers, Cron & the Listener Runtime for the arming mechanics.
One lifecycle, evidence-first at every stage
The reason "completion is not accomplishment" isn't just the T stage's private slogan is that the whole SWIFT lifecycle is built around the same refusal, at every letter: Scope refuses to let "done" go undefined, Iterate refuses to let a generated test case gate on its own say-so, Formalize refuses to harden anything that hasn't actually proven itself, and Truth refuses to trust a run's own report of what happened. See What Self-Healing Actually Means for how repair fits into this same discipline once something does go wrong.
Success paths are compiled against terminal data
A definition-of-done expression reads the canonical terminal data, not the viewer envelope used to render a return_output card. Workflows that grade output.* declare an outputContract; Scope and App Compile reject top-level references absent from that contract before a live run. When a runtime check still fails, the verdict evidence lists the available canonical paths without exposing their values, so repair is one grounded edit instead of repeated guesses.
Repair a verdict without replaying the side effect
If persisted node evidence proves that execution and the real-world action succeeded but the acceptance contract was wrong, repair the spec and call agentis.run.regrade. Regrade evaluates the completed run's stored terminal surface and world probes in place; it does not dispatch workflow nodes, resend messages, redeploy, or repeat payments. A fresh run is reserved for changed inputs or deficient producer evidence, not for refreshing a verdict.
Continue
The exact loop: draining the ready queue up to a parallelism cap, a three-way dispatch decision per node, and the counter that stops a run from settling mid-dispatch.
Four real mechanisms working together — a recovery ladder, a law against silent restructuring, a pattern-recognizer for repeat failures, and a safe way to change a live run — not a single feature.