Part 05Coordinate the work

Durable workflows—not agents in a loop.

Temporal owns scheduling, fan-out, waiting, retry, cancellation and recovery. Stateless reasoning components remain bounded activities inside the workflow.

Workflow control plane

Every unit of work has an identity, state and owner

Start

Schedule, clinician request or a meaningful domain event starts a workflow with a stable business ID.

Checkpoint

Temporal records orchestration history; PostgreSQL records product state, versions, budgets and audit references.

Resume

A replacement worker replays history and continues from the last completed activity after a crash or deployment.

Wait

Signals resume workflows after clinician approval, new patient data or an external result—without holding a process open.

Cancel

Cancellation stops unstarted work, asks active children to stop and preserves completed evidence and audit history.

Observe

Search attributes expose tenant, clinician, patient, workflow type, status, risk, version and cost without logging PHI.

Parent workflow

Owns scope, snapshot, budget and aggregate result

Bounded child workflows

Isolate each patient or inbox item

Typed activities

Perform I/O, model calls and approved actions

Deep dive · PanelReviewWorkflow

One review coordinates thousands of facts—not thousands of agents

~1,200 patients

Freeze review

Create review_id; snapshot panel membership, patient-state versions and policy versions.

Score cheaply

Run safety overrides, eligibility rules, change detection and longitudinal SQL/features for all 1,200 patients.

Select candidates

Keep roughly 30 strong candidates; reuse any fresh, already-validated DecisionCandidates.

Fan out safely

Start at most eight patient child workflows that need fresh reasoning, with bounded concurrency and budget.

Collect + rank

Accept typed results, isolate partial failures, deduplicate actions and apply the explainable priority policy.

Publish queue

Write a frozen, evidence-backed weekly queue and notify the clinician only when it is ready.

Wait for decisions

Receive approve, modify, dismiss, defer or request-information signals per candidate.

Close + learn

Track execution and outcomes, write feedback records and continue-as-new before history grows unbounded.

Bounded concurrency

A semaphore limits child workflows and model calls by tenant, clinician and model tier.

Partial failure

One failed patient never discards 29 valid candidates; missing coverage remains visible.

Budget stop

The parent stops new deep work at the ceiling and publishes an explicitly partial queue.

Architecture generalization

Three requests; three workflow shapes

Panel prioritization

“What should I focus on this week?”

Unit of work: PanelReview parent + PatientDecision children
Trigger: Weekly schedule or clinician pull
Path: Snapshot → deterministic score → bounded fan-out → rank → queue
Output: Ranked, actionable weekly queue
Latency: Minutes; partial progress visible
Failure mode: Publish successful candidates; mark missing coverage explicitly

Inbox drafting

“Draft responses to my inbox.”

Unit of work: One InboxItemWorkflow per message, result, refill or staff task
Trigger: Item event, batch request or retry
Path: Classify → load patient/thread context → safety route → draft/hold/escalate
Output: Draft queue with reason, citations and required reviewer
Latency: Seconds to a few minutes per item
Failure mode: Never guess: hold, label the missing context and route to a human

Practice improvement

“How can I improve my diabetes management?”

Unit of work: PracticeInsightWorkflow over governed aggregate features
Trigger: Monthly schedule or clinician pull
Path: Define cohort/measure → aggregate → compare over time → explain → drill down
Output: Three evidence-backed patterns and suggested experiments
Latency: Minutes to hours; not on the patient hot path
Failure mode: Suppress unstable slices; disclose small samples and missing/confounded data

Temporal semantics

Orchestration is deterministic; side effects are activities

PrimitiveResponsibility

Activities

All I/O: database reads, model calls, notifications and EHR actions. Retry transient failures only.

Child workflows

One durable unit per patient or inbox item. Bound concurrency; isolate failure and cancellation.

Signals

PatientStateChanged · ClinicianDecision · ExternalResult · CancelReview

Queries

Progress · candidate counts · current budget · waiting approvals · failure coverage

Timers

Batch windows, approval expiration, SLA escalation and scheduled refresh without worker sleep.

Continue-as-new

Roll long-lived histories forward while preserving the stable business identifier.

What breaks in a for-loop

A process crash loses progress; retries duplicate actions; deploys interrupt work; approvals cannot wait safely; cancellation is ambiguous; one patient failure poisons the batch; and nobody can explain which versions produced the result.

Clinician experience

One inbox for prepared work—not another stream of alerts

This week

Ranked actionable queue

8 items

Needs attention now

What changed · why now · suggested action · evidence

Review today

Confidence · missing data · required approval · expiry

Monitor / prepare

Next trigger · owner · status · expected completion

Every item supports

Approve

Modify

Dismiss with reason

Defer until date/event

Request more information

Escalate

Workflow principle

Temporal remembers how work progresses. PostgreSQL remembers what the product knows. Agents reason briefly inside both boundaries.

Decision architecture Next: Data & state