Stop starting work that cannot finish.

Stop starting work that cannot finish.

A run that starts against an empty API window, a spent model-credit budget, or a dependency already returning 503 does not find a defect. It consumes the remainder of a shared budget, fans child work out from a degraded exit, and pages an operator for exhaustion the estate produced by starting. CI and agents draw on the same scarce machine resources: API windows, runner slots, model credits, dollars, and dependency health. A rate limiter prices one call. A durable engine keeps execution crash-safe. A CI platform owns the pipeline. None of those systems decides, before spend, whether the work can finish against all of those resources together.

Quelor is Agentic Workload Admission, a forge-neutral control plane. Agentic names the workload shape: bursty arrivals, fan-out, and units whose cost is not fixed in advance, so CI graphs and agent sessions share one policy. It leases capacity before spend, renews honestly for long agent sessions, defers what cannot finish, and classifies outcomes so only real defects wake operators.

The unit of product is the admission decision, traced and auditable. You keep your credentials and your queue. AcquireLease answers before spend with ADMIT, DEFER(until, reason), SHED, or DENY. Unknown readings are never treated as available. RenewLease grants the next quantum; refusal means checkpoint and hibernate. SettleLease is idempotent by lease id and returns declared versus consumed. On defer, park the work, not the runner. Release fires on events: a window reset, health recovery, or lease expiry. The classifier is deterministic: resource-exhausted, dependency-unavailable, flaky, real-defect, unknown. Exhaustion and outages exit degraded. Red is reserved for a real defect.

Every verdict carries a decision_ref. The work envelope names the tenant, a coalesce key, a priority, declared costs, dependencies, resources, a generation, a not-before time, an opaque payload, and the holder. That is the unit a Decider sees.

We open the lease API, the envelope, the adapters, and quelord, a deterministic engine you can run in minutes. The binary enforces floors, caps, and coalesce, applies AIMD on observed 429 and 503 responses, classifies into the five classes, renews progressively, routes to a home cell, and holds meta-admission quotas. The Decider interface is pluggable. The reference implementation is YAML plus bounded CEL. Every answer carries a decision_ref, a ruleset id, and a ruleset hash. Bring your own Decider if you want. Replay and conformance are how you prove it. One environment variable forces the reference Decider. The hot path does not call a model.

Rules first, judgment last.

The hosted service is optional. It adds multi-tenant cells, isolation, audit, managed SLOs, and FinOps views, and it uses the same Decider interface. Hosted cells improve from fleet telemetry; promotions require observed outcomes. No model sits on your outage path. When the Decider is unavailable, the engine applies class policy and stamps the verdict bound-unreachable.

Admit before start. Release on events. Page on defects.

Quelor - workload admission and flow control for the agentic era.