orrery

Orrery provides an architect-first orchestration framework for coding agents, designed to maintain human control over the development process. It addresses the challenges of multi-agent systems by ensuring exact model pinning, consented writes, and a fail-closed security model. The system defines four distinct AI roles, or "bodies," each with a specific job and model pin: * **Astra**: For high-complexity tasks like security logic, concurrency, algorithms, and migrations, pinned to a high-reasoning model. * **Terra**: For bounded, mechanical, and well-specified work, pinned to a standard reasoning model. * **Sol**: A read-only advisor that provides a fresh final review, returning `ship`, `fix-first`, or `rethink`, without implementing fixes itself. * **Luna**: An explicit opt-in lane for user-visible Codex app tasks, never a fallback. The human architect, acting as the "parent chat," owns requirements, architecture, decomposition, diff review, and acceptance. The system delegates implementation to either Astra or Terra, ensuring they are mutually exclusive. Routing is strictly enforced; if a selected lane's model or effort is not observed, the process stops. The parent verifies all changes by inspecting the working tree and re-running verification commands before Sol provides a verdict. Orrery's security model is built on the principle that "the model can never choose where a file is written." Destinations are derived, not supplied, and writes are allowlisted and re-checked against the workspace root. It employs exact plans with single-use tokens, second tokens for user scope, and prevents silent clobbering of files. Crash-safe transactions and serialized mutations further enhance reliability. The system also implements tool-surface consent, where any change to tool descriptions requires human re-approval, preventing "rug pull" attacks. It supports various clients like Codex, Cursor, Claude Code, VS Code, GitHub Copilot, and Kiro, explicitly stating what each host can and cannot enforce regarding read-only behavior and effort binding. Orrery provides read-only commands (`plan`, `doctor`, `tools:review`) to verify its claims offline, ensuring transparency and trust. It is not intended for single, bounded edits or as a fire-and-forget agent, emphasizing that human inspection and verification remain crucial.