The product, in full

“Two agents took the same ledger item.”

Both finished. Both were paid for. One diff had to be thrown away, and neither agent ever knew the other was there.

“Project A rebuilt what project B already had.”

Same workspace, same week, same retry helper. There was no way to ask the other project's agent whether it had already solved it.

“Every dashboard quotes a saving I cannot reproduce.”

A percentage on a slide is not a measurement. You want the number from your repo, and you want to see how it was counted.

1. Install & bind

Put orch in its own folder. Run orch setup and pick a separate workspace for your code. The client install is not the workshop home.

2. Open a seat

Go into a registered project folder and run orch opencode, orch claude, orch commandcode, or your agent. The first interactive seat is the Chair. A second Chair on the same project is blocked.

3. Chair vs workers

Why one Chair: if every agent acts like a director, they race the same files, invent duplicate helpers, and the work knots. Workers are for secondary tasks, directed by that Chair — not a second orchestra on the same project. Arrival order picks the Chair; you don’t appoint it in chat. Need more hands? Spawn workers; don’t open another Chair. The Chair's own code-file writes are capped too: the 3rd gets an advisory naming dispatch_worker, the 4th is denied. Any blocking guard fails the dispatched task and makes worktree_promote refuse it. The Claude Code PostToolUse hook moves bulk tool output to disk instead of the transcript, so it never costs context twice. Dispatching two workers from one Chair in the same turn runs them concurrently, not one after the other.

4. Shared code

Before editing common paths, take a lock. Search the registry before writing the helper. Edit, then release so teammates see the refresh. Don’t edit shared without a lock.

5. Claim the item, talk on the bus

Claim your ledger line so nobody else takes it. Leave short notes and handoffs for the other seats (inbox / notices). Use Orchemax messaging, not a parallel vendor chat between agents.

6. Optional cloud

Link an Orchemax account when you want caps, spend visibility, and the CTO overlook. Source stays local; the cloud sees metadata, not your repo.

Testing: proof is proportional

Writing code never waits on a test suite, and closing a session never runs one. A change runs only the tests it reaches, and a pass on identical code is reused. When full verification is needed, you are told its measured time and you choose when it runs. A change that skipped it is labelled unverified, never passed.

orch try <session|branch> merges accepted branches in a separate train directory, builds and installs them with a rollback copy, runs no test suite, moves no branch and pushes nothing. orch status then shows the install as orch try, unverified until orch land --install replaces it, and orch try --rollback restores the previous one. It is the short path on purpose, and your own timings are in orch stats.

orch land verifies whole packages, bisects a failing train by branch, reruns only the failing tests, lands the rest, and can push and install. Planned: a land that runs only the tests the change reaches.

Nights you can trust: orch nightly run lands every accepted, unlanded session in one train, inside a window you choose (verify.nightly.start and verify.nightly.end). It rehearses the land on a throwaway copy first and lands only what passed; the morning report, with what landed and what was refused and why, waits in your next start brief until orch nightly status reads it.

Faster, honest checks: the seal runs a check only when the change reaches it, and audits, seals, rehearsals and the doctor share one workshop build cache. A test result a worker claims is re-run by the seal and judged, never taken on its word; the re-run accepts only allowed flags, environment and packages.

Any language: orch test and orch repro run the test adapter of the project's language, and name a missing adapter instead of guessing.

Sessions: a start that briefs you, a close that stays light

The Chair opens with a first message of its own, in your workspace.locale (en or es-US), and a start brief: the last-session card, pinned memories, lessons that recurred in the last 7 days, open learning rows, the state of the work (running, accepted and waiting to land, waiting for audit) and the decisions waiting on you.

While a seat starts or closes, one animated line shows the current step and elapsed time; it stays silent off a terminal and under NO_COLOR, ORCH_NO_SPIN and ORCH_QUIET. Closing a Chair runs no worker seal tests, merge preview or repo gate; it judges only its own commits. A sealing worker is never shown as stalled.

The handoff and the session card are written when a session closes or re-seals, in every wiring mode, so the next start reads a brief that is already built. While a Chair runs, what it last wrote rides along in the card.

The bus: your machines work as one

A note typed in a seat on one machine reaches a seat on another, and the sender sees a read receipt when it lands. Each machine reports whether it is online and what it is running; orch machines prints that table. A Chair sitting idle is woken when work arrives for it instead of waiting for your next message.

One machine holds the coordinator role, so two machines never hand out the same work. If it goes quiet, the next machine takes the role on its own and the handover is recorded; a machine that was superseded and comes back is told who holds it now.

The gateway: three ways to pay for models

Your own vendor account. An interactive seat keeps the login you already pay for, and nothing is routed through Orchemax.

Your own provider keys. The gateway uses the keys in your config and nothing else.

The Orchemax gateway. Model traffic goes through Orchemax instead of a key of yours.

The lane is set per seat (agents.auth, --auth), so a Chair and its workers can use different ones. A provider that errors or rate-limits goes into cooldown and the work continues on the next one. orch gateway status shows the live state, the cooldowns and the rotations; what a run cost and saved is in orch stats, measured on your own traffic rather than printed here.

Notifications: only when you must act

A desktop toast appears only when something needs you. Worker results (sealed, failed, ended, stalled, needs an answer, handoff) never toast while a Chair is open, and the Chair's idle prompt does not toast while its own land, audit or seal is running. Every line of the notify log ends with delivered=toast or delivered=none reason=<reason>, so you can read why nothing reached you. Some callers and a toast timeout are still being moved onto the same rule.

Workshop layout: removable by deleting one folder

Orchemax data lives under the workshop's .orch/ and each project's .sandbox/<seat>/, and a seat's temporary files go inside that scratch folder. Scratch is swept after guard.sandbox_days (14 by default) and never holds durable knowledge: that lives in Orchemax memory and in files you track. A seat's scratch root is the workshop's own sandbox, so nothing of a seat's temporary work lands outside the workshop.

Learning: lessons arrive where the action is

A lesson is shown at the moment it applies: dispatch, brief, audit, land or edit. A lesson broken after it was shown becomes a gate, and until it has one only base work is dispatched (the needs-gate rule). Every override is written down and counted, and recurrences are counted per lesson. More gates are planned. Learning is measured: a new lesson starts on probation and is settled by accepted green seals; one that is not injected for 60 days (learn.expire_days) goes dormant. An opt-in cheap proposer (learn.propose: off, shadow or on) drafts lessons after a failed seal and a deterministic promoter validates them, and orch learn curate merges near-duplicates (a dry run until --apply).

Stats: what happened, in numbers you can read

orch stats groups by guard and verdict, by surface and by rule, so you can see which guard actually fires and which never does. Gateway failovers and cooldowns are counted per provider, and the learning counters show what was proposed, promoted and expired, and what it cost.

Every number on this page that is not yours to read in that meter was removed rather than rounded: a figure from one run on one machine is not a measurement you can hold us to.

Worktrees and locks

A worktree per agent session is the industry default, and it only isolates. Orchemax adds the logical lock taken before the shared edit and the symbol registry consulted before the helper is written — then orch worktree promote merges fail-closed on conflict and never auto-pushes. Prevention and isolation, not one instead of the other.

A reaper that finishes the job

Watchdogs that notice a hung agent are common. This tick also fails the task, releases the lock, removes the worktree, sweeps expired externalized context and drops graph edges whose target symbol is gone — in one pass, with no extra database and no terminal multiplexer. Liveness watches the agent's own child PID with a grace window; the interval is yours, unset is 60s and 0 is off.

Gateway: your keys, one connection

Several keys per provider in a local vault as a rotating ring, each probed for connectivity before it is saved and never printed back. orch gateway status shows live/cooldown state, ring position and rotation counts, content-free. Claude Code keeps its plan: the gateway refuses an account bearer on purpose and tells you why.

Compression that reports net

The compressor is generic over any tool output, falls back to raw when parsing fails, and reports bytes saved after its own overhead. Errors, stack traces and non-zero exits are kept verbatim — compression that hides a panic is a bug, not a saving.

Heterogeneous workers over one protocol

Orchemax speaks ACP (JSON-RPC over stdio) as the client. Set agents.transport to acp and a Gemini CLI or OpenCode worker reports structured tool calls and results instead of scraped stdout; the default transport is still a subprocess. Verified for those two; Codex, Claude Code and Cursor run as subprocesses. A worker's permission request routes to the Chair through ask, so it can be approved by an agent rather than a human at the pane.

Your own rules, plus six default guards

Deny, require and cmd checks you write in .orch/gates/user/manifest.json run at the same sealing, git-hook and IDE-hook points as the built-in guards. Orchemax also ships six default guards: docs, signature, upsert, env-drift, shared-shadow and template-drift.

Your IP stays private

A project declared public accepts only the paths its publish.allow globs name; any other path is refused at commit, push and seal, and a rule that cannot be read fails closed. orch doctor warns on a public origin that declares no visibility.

Consent before touching your profile

Project-scope hooks (.claude/settings.json, .cursor/hooks.json) install by default from a clean orch setup. Anything that would write to your user profile instead asks first, names the file, keeps a timestamped backup, and ships an undo command (orch guard unwire).

Active plan gates & DDL discipline

Free → Starter → Professional → Team. Agents call entitlements_status; quota and plan denials carry upgrade hints, and local Free caps apply when unlinked. Promote can require seeder and repository companions beside a migration so agents do not leave orphan schemas. ORCH_TASK_TOKEN_BUDGET caps a task's budget before it spawns; local secret masking keeps credentials out of the usage ledger and anything pushed as an event.

Usage controls

Caps on projects, concurrent agents, devices, and runs. Token and spend visibility by project and model. Soft stop before the invoice surprises you.

Work schedules

Define when agents may run: business hours, quiet nights, freeze windows before releases. Policy travels with the org, not a sticky note in Slack.

Team allowlists

One Chair per project on the floor; Team allowlists who may dispatch and who may touch shared, so “anyone with a CLI” is not your security model.

CTO overlook

Governance events, ROI hours, live fleet pulse. Professional: overlook + Telegram soft notify. Team: Assist HITL (approve/deny) in /app and on Telegram. Metadata only, never source. You renew the subscription because you can see the floor.

Is this another layer between me and my agent?

No. Orchemax does not proxy your traffic and does not replace your login. It registers MCP tools your agent can call and one harness hook. The CLI you open is the CLI you had.

Will it break my Claude or Codex subscription?

It used to — a bug injected API credentials into a plan login and killed the subscription. That is fixed, the gateway now refuses to substitute an account credential and says why, and plan-billed seats are compressed by the local hook rather than routed anywhere.

Does my source reach your cloud?

No. The runtime is local. A linked account receives counters, model names, session ids and governance events — content-free by payload schema, with a regression test that fails if code text ever appears in it. Unlinked workshops keep working.

We already use git worktrees. What is left?

Worktrees isolate and defer the collision to merge time. What is left is the lock taken before the shared edit, the registry consulted before the helper is written, the claim on the ledger line, the reaper that cleans up after a crash, and a promote that refuses rather than guesses.