Atelier V2 (Agent Studio)

What it is

Atelier V2 is a web application where you define AI agents as data (prompt sections, tools, skills, tech stacks, model), then hand a project one request and watch a team of agents plan, build, review and push the result. Roles like Frontend Engineer, Backend Engineer and Team Lead are rows in the UI, not code paths. A new role needs no new Python.

How it works

• One contract, both sides. An OpenAPI 3.1 file is the source of truth. The Next.js client is generated from it, and CI fails if the FastAPI routes drift.
• Workers and supervisors share one shape. A worker builds in an isolated workspace; a supervisor splits the request into tasks, dispatches them, reviews each result and only marks the parent done when every child is approved. Supervisors stack (reviewer, then QA, then PM) on the same generic LangGraph graph.
• Sandboxed execution. Each run gets an unprivileged Docker container with only the project mounted. The container reaches the internet through a proxy that allows the npm registry, GitHub and the preview host, and nothing else. A local fallback mode confines writes to the project folder.
• Single model gateway. Every model call for every role goes through one LiteLLM gateway with request capture, tool-call pairing checks, first-token and total timeouts, and retries. OpenAI and Gemini are live providers.
• Enforcement in the runtime, not the prompt. Tool access is checked against the agent’s allow-list. Enabled tech stacks are enforced by a package-install allow-list and a pre-run scan. Secrets never enter model context or event payloads.
• Live runs over SSE. Every state change is an appended event. The UI is a reader of events: streaming tokens, tool calls, diffs, screenshots, a live preview and a stop button that kills the sandbox.
• Evals gate prompt versions. Each agent carries evals that are real runs in a throwaway folder. A prompt version cannot be set active until every eval passes.
• GitHub output. When a project is connected, a task commits on a branch, pushes and opens a pull request with a readable name.

Engineering notes

The repository has 240 API tests and 24 browser tests, a gitleaks and custom secret scan in CI, and an architecture decision record that explains each layer choice, including dependency pins chosen after a supply-chain incident in an upstream package. Hardening work covered SSRF bypasses, cancel-during-prep races, resource leaks and quadratic hot paths in the event log.