Stop starting work that cannot finish.
Quelor is an open-source admission and flow-control plane for CI and agent work. It leases capacity before spend, renews honestly, defers what cannot finish, and classifies outcomes so only real defects page a human.
The problem
CI and agents share scarce machine budgets: API windows, runner slots, model credits, dollars, and dependency health. Estates launch into empty capacity, go red, and page humans for exhaustion that was never a defect.
Rate limiters price the call. Durable engines own crash-safe execution. CI platforms own pipelines. Nobody owns admit-before-start across all of them.
How it works
Admit
AcquireLease returns ADMIT, DEFER(until, reason), SHED, or DENY before spend. Unknown readings are never treated as available.
Renew
RenewLease grants the next quantum for long agent sessions. Refusal means checkpoint and hibernate.
Settle
SettleLease is idempotent by lease id. It returns declared versus consumed.
Classify
A deterministic classifier assigns one of five classes: resource-exhausted, dependency-unavailable, flaky, real-defect, or unknown. Exhaustion and outages exit degraded. Red is reserved for real defects.
On defer, park the work, not the runner. Release runs on events: window reset, health recovery, and lease expiry, with no standing poll. Every verdict has a decision_ref trace.
Quickstart
This GitHub Actions step is illustrative: in Mode A you keep the credentials and the queue, and the step admits a declared GitHub API cost before spend.
- uses: coherera/quelor@v0
with:
resources: github-api
declared-cost: 40
mode: A # Mode A: you keep credentials and the queueExact inputs are in the repository README.
Open and hosted
The open project and the hosted service share one Decider interface.
| Open (Apache-2.0) | Hosted |
|---|---|
|
|
Rules first, judgment last. No model sits on your outage path.
Quelor is part of the COHERERA open ecosystem, and that is where this leads.
Origin
On 2026-10-31 one production estate produced about 340 failed CI runs in a day. The largest buckets were not defects: about 61 dependency-path reds from a shared service returning 503 and timeouts, and about 41 rate-limit reds against a shared installation-token budget of 1,000 requests per hour per repository, shared across hosted runners, cloud runners, and laptops.
Fixing alerts one by one failed. Reruns spent the same empty bucket. Child workflows fanned out on degraded exits. Duplicate event workflows raced. The failures were self-inflicted by work that started without checking it could finish. We built the admission layer we needed, then made it open.