# orch core

**Let coding agents do the work. Keep every decision yours.**

orch core runs coding-agent work through tickets on a fixed path. Agents write the requirements, the plan and the evidence. You sign the requirements, the plan and the verdict in a physical way, with your fingerprint or your phone. An agent can type any command, but it can't put a finger on the sensor. It works with Claude Code, Codex and any agent that has a shell.

## Four problems it solves

- **I lost control.** Too much at once. orch core shows open tasks, questions and the last status in one place, and every ticket has a current-state note.
- **Not what we agreed.** Requirements and plan are signed before any code. A change voids the signature.
- **"Done" isn't done.** Every acceptance criterion needs evidence before the ticket reaches you. Your verdict signs one commit.
- **Same discussion again.** Every answer and decision is a signed event on the ticket.

## How it works

A request comes in, in the requester's own words. The agent gets the keys and knowledge it needs, follows your skills and rules, and writes every step into the ticket. People answer questions and sign the gates. Results go back to the tracker, docs, code host and data platform, and every finished ticket feeds the knowledge base.

Every ticket has three gates: requirements and acceptance criteria, plan, and verdict. Each needs a person's signature, given with a physical act: a fingerprint or the phone (Face ID). Hardware signers such as a security key or a TPM chip are next.

## A checklist, and evidence for every item

The acceptance criteria are agreed before the work starts (gate 1). The agent ticks each one off only with evidence: a test run, a row count, a report, a screenshot, a link to the change. Your verdict unlocks when every criterion is proven, and it signs the evidence and exactly one commit.

## Mission Control and orch mobile

Mission Control is the desktop dashboard: Today (what waits for you), the board, ticket pages, and approve and verdict prompts that show exactly what you sign. orch mobile is the iPhone app: answer questions and sign gates with Face ID, push notifications, and Drop for files.

## AI Factory and Dark AI Factory

For bigger requests you sign a charter instead of every gate: the maximum number of tickets, the size per ticket, a hard budget cap, the target (Preview or Deliver) and a hold window before delivery. Inside the charter the agents split the request into tickets and build them; the charter approves their gates, marked "via the charter". Before delivery there is a hold with Stop, from the desk or the phone. A code-review gate, if turned on, is never auto-approved.

- **AI Factory:** lights on. You watch the board and can step in at any gate.
- **Dark AI Factory:** lights off. One signed request runs end to end, with restricted permissions. You sign it in and can stop it before it ships.

## Architecture

A workspace is one team's or person's space for a project or client. Agents work through the orch CLI, the workspace host holds the keys, and everything lives in plain, signed files. For a company, one orch hub connects all its workspaces and your phone. The relay and publish at the edge only ever see ciphertext.

- **Workspace:** tickets, agents, skills, memory and its own keys. Plain files per ticket (`ticket.json`, `body.md`, `events.jsonl`, `artifacts/`); every change is an appended, signed event.
- **orch CLI:** agent-first commands (`new`, `claim`, `task`, `ask`, `artifact`, `submit`).
- **Workspace host (`orch serve`):** the only process that holds the workspace keys; enforces gates, roles and policies.
- **Mission Control and addons:** GitHub reviews and issues, Databricks, wiki, terminals, schedules, quick tasks, or your own.
- **orch hub:** one per company. People sign in once; admins give groups read, edit or admin access per workspace. It routes handoffs, keeps shared spaces and a signed audit log, and serves the browser home. In full mode it is a trusted operator like an identity provider and holds each user's signing key; every signature still needs a fresh tap on the phone or a passkey.
- **Selective join:** a personal workspace can join without giving the hub its key and shares only what its owner picks.
- **Standalone:** a workspace without a hub works on its own. The hub is an addition, never a dependency.
- **orch-relay:** directory, relay, Drop and push; stores ciphertext only; carries phone push and hub-to-hub traffic. Workspaces dial out to the hub; nothing dials into a workspace.
- **orch mobile:** the iPhone app; pairs once with the hub by QR.
- **orch-publish:** shares and small apps over HTTPS, forwarded by the hub, signed by the workspace, released only after human approval.
- **Linked workspaces:** hand tickets to another workspace and continue with the result. Hubs of different companies link through a relay.

Code: https://github.com/severinlindenmann/orch-core

License: PolyForm Noncommercial License 1.0.0 (source-available; free for noncommercial use, commercial use needs a license).

By Severin Lindenmann, https://severin.io/en/