- Zero runtime dependencies, 73 offline tests
- Role files for six clients, from Codex to Kiro
- The model never chooses where a file is written
Architect-first orchestration for coding agents. Your chat keeps the architecture and the acceptance; Astra and Terra implement on risk-routed lanes; a fresh read-only Sol returns ship, fix-first or rethink. Every model pin is checked against the routing actually observed, and a substituted worker stops the lane even when its work looks correct. It is a zero-dependency MCP server that writes role files for six clients.
Four bodies, separated by remit rather than capability. Astra runs at the highest reasoning budget and takes authorisation, concurrency, algorithms, hard debugging, migrations and anything with a wide blast radius. Terra takes bounded, fully specified work. Sol is read-only, returns exactly one of three words — ship, fix-first, rethink — and never implements its own fix. Luna is an opt-in application-task lane that is never reached by fallback. The parent chat stays the architect: requirements, architecture, decomposition, diff review, rerun verification and acceptance are never delegated.
Routing is enforced at acceptance, not requested at dispatch. If the parent selects Astra and observes Terra, that is a substituted worker and the lane stops, even when the work looks correct. Every other failure is fail-closed too, never a warning: a changed tool surface blocks all stateful operations, an unavailable pinned model stops the lane, unobservable routing stops the lane, and a broadened sandbox stops the review.
The security invariant is one sentence: the model can never choose where a file is written. Destinations are derived from the client, the scope and the workspace against a fixed filename table, and the write set is exactly three known paths, each refused if any component is a symlink. A preview mints a single-use token bound to a SHA-256 digest of the planned content and the observed disk state, expiring in ten minutes; writing at user scope takes a second, independent token. Crash safety runs off an fsynced write-ahead journal, so a rollback follows recorded intent.
It answers the supply-chain problem specific to tool servers. A digest over the complete tool surface — every name, description, schema and behaviour annotation — is pinned in CI and recorded at setup as the version the user approved. Any later drift reports a changed tool surface and blocks every stateful operation until a human re-approves, and a review command names exactly what changed.
Zero runtime dependencies, 73 offline tests, and three read-only self-audit commands — plan, doctor and tools:review. Six clients are supported: Codex, Cursor, Claude Code, VS Code, GitHub Copilot and Kiro. Where a client cannot bind per-agent reasoning effort, ORRERY refuses to store one rather than persist a setting that would never take. It shares its lane vocabulary with FABLEWRIGHT, its sibling.