Modulo is built on nine engineering principles: schema seams, immutable snapshots, deterministic gates (with guardrails at the ingestion edge), audit as a first-class output, humans in the loop where it matters, secret hygiene, dispatch-not-run, correction-never-rewrites-history, and self-hosted-no-telemetry.

Schema seams

Every boundary in a pipeline can be a typed contract - schemas are opt-in. An agent can declare an input_schema and an output_schema; when both sides of an edge declare one, compatibility is checked, and an output is validated against its schema when that schema is present. Untyped boundaries pass through unchecked. What you see is what runs; mismatches at a typed seam fail loudly.

Immutability of runs

When a run starts, we freeze the whole pipeline definition into a snapshot before anything executes - every agent version, schema pin, connector binding, model backend, and prompt hash. Nothing resolves live, so pausing and resuming a week later behaves the same. The run you inspect is the run that happened. (See all first-class versioned entities for the full list.)

Audit as a first-class output

Every state-changing action produces an immutable audit event, timestamped and org-scoped. Governance requires a record you can trust after the fact; the trail is a product output, not an afterthought.

Deterministic gates

Gates produce a clear pass or fail, and the run history shows which gate caught what. Regex, schema, and custom-function gates are deterministic: the same input produces the same result every run. A scored eval gate uses an LLM judge with a pass threshold, so it is a judged (soft) gate. Either way the run proceeds or pauses for review. Deterministic gates catch failures before a human reviewer; judged gates add a quality signal, and audit records what each gate decided and why, so a reviewer never sees a decision without its evidence.

Guardrails at the ingestion edge

Deterministic gates check what leaves a node; guardrails check what enters a run, evaluated at run creation before the input payload is persisted - deterministic only, regex or JSON Schema, with no LLM judge on the input side. Actions are observe, warn, block, or redact. A block is terminal: the run never dispatches and there is no human-in-the-loop gate. Redaction masks matched values before persistence, so raw secrets never reach the audit log. Remediation is the guardrail-override endpoint, which re-runs the guardrail pass on the operator-supplied input rather than resuming on the blocked payload, so re-blocking is always safe. The agent definition is the driver's manual; boundary controls are the enforcement that stops a credential or disallowed string in a webhook payload before any node sees it.

Humans in the loop where it matters

Every gate is atomic - one claim, one decision, an audit record either way - and an agent cannot unilaterally approve its own block-level changes. A separate reviewer or a human must clear any block-level gate before a change reaches production. Modulo gives you the tools to decide what your agents can do - permissions, gate configuration, and autonomy levels - and the system enforces them.

Secret hygiene

Credentials are decrypted once, at run start, into a run-scoped context. They never touch agent state, checkpoints, or logs, so one-decrypt-per-run bounds exposure.

We dispatch, we don't run agents

We dispatch work to the runtimes you already use, and own everything around it: auth, audit, cost, eval gates, and human review. Established agent runtimes do tool-use better than a platform can, so we dispatch instead of competing. Swap runtimes without changing governance; your stack stays yours.

Correction never rewrites history

A failed output produces a new run with the feedback attached, and the original stays as it was. The correction loop is a first-class pipeline that produces a new run, not an in-place edit of the original.

Self-hosted, no telemetry

Your infra, your data, no cloud dependency. Modulo runs on Docker Compose, Fly, or standalone SQLite mode, with no telemetry by default. For regulated and IP-sensitive teams, governance without data ownership is not viable.