OrchestKit · CC adoption · 2026-08-29 · operator page · design
"Floor 2.1.251 now, and we want to adopt all." This is the target architecture after every 2.1.243 to 2.1.251 capability is in, laid out as the five layers ork already has, what changes in each, and the three waves that get there. Three decisions at the bottom shape the waves.
if: measured out)ork's CC integration is already layered; nothing here adds a layer. Green boxes are shipped or in flight today; amber is wave 1; blue is wave 2; purple is wave 3. The contract layer at the bottom is what every other layer is allowed to assume.
| Item | Layer | Design | Proof before merge | Wave |
|---|---|---|---|---|
| Floor 2.1.251 | contract | cc-support.json floor=latest=latest_known, stamp sweep (113 files), six CI pins, fixture + integration test, matrix unit test | full vitest, every test-cc-*.sh, floor/ceiling tests; plugin validate on 2.1.251 in CI | today |
| PreModelSwitch / PostModelSwitch | hooks + analytics | consent gate mirrors the spawn gate under one env var; telemetry line per switch; guard allow-list extended | 3-run E2E (Fable blocked, ORK_FABLE_OK allows, Opus untouched); 2.1.250 control shows why the floor moved | #3792 |
| SessionStart staleness | hooks | lib/session-staleness.ts readers; handoff injector skips warm recent resumes; perf log carries the fields | captured resume payload as fixture; unknown fields never read as recent | #3792 |
if: on the Bash guards | hooks | Measured out. PreToolUse Bash is one entry (sync-bash-dispatcher) running 15 sub-guards in-process, p50 6 ms / p95 68 ms over 661 calls; every sub-guard needs every command, so if: could only skip it by splitting it into more spawns. The two existing if: uses are the right shape. | hook-timing.jsonl, 7-day window, 2026-08-29 | n/a |
experimental.cacheTtl: "1h" | agents | frontmatter on agents that run inside workflows or wait on CI (audit-full, eval-runner, ci-cd-engineer, code-quality-reviewer); decision 2 sets the scope | /cost prompt-cache line on a fan-out run before vs after | wave 1 |
--restricted smoke lane (#3774) | contract | CI job runs claude -p with --restricted --plugin-dir plugins/ork; every hook that shells out must fail loudly, which is the assertion | the job is red until the failure list is enumerated and accepted | wave 1 |
| Permission-rule wildcard lint (2.1.246) | hooks | test over src/settings/*.settings.json rejecting Bash(x * y) shapes | lint green on current rules; positive control rule fails it | wave 1 |
| maxTurns partial results (#3766) | skills | agent-spawning skills recognise "partial, continue via SendMessage" instead of treating silence as failure; empty-result-detector gets a third verdict | fixture from a real partial result; detector base-rate re-measured | wave 1 |
modelPricing + prompt_cache in cost | analytics | cost-estimator honors configured rates; status-line prompt_cache object ingested; ork:analytics answers hit ratio | unit tests on the captured status-line object; one session's numbers reconciled against /cost | wave 1 |
type: prompt hooks | hooks | the two regex guards that misfire on worktree branch names become model-evaluated; decision 1 | #3770 audit is clean, so the stdout contract holds; A/B on the recorded false-positive corpus | wave 2 |
asyncRewake on background verifiers | hooks | the #3779 verdict class interrupts with its finding instead of waiting for the next turn | one real verifier run rewakes the session; no double-emit | wave 2 |
| brainstorm + review-pr as workflow scripts | skills | the two most-used fan-outs get resume, per-agent cache and the size guideline for free | same outputs on a fixed prompt; token count per run before vs after | wave 2 |
| SendMessage reply note + cross-session everywhere (#3772, #3773) | skills | doc updates in chain-patterns and the 19 agents that grant SendMessage; no code path changes | grep proves every mention states the parent-delivery rule | wave 2 |
sandbox.enabled (#3322) | hooks | retire the regex egress guard behind CC's own sandbox; honored only from user/managed scope, so ork documents and detects rather than ships | doctor reports the posture; guard becomes advisory when sandbox is on | wave 3 |
plugin dependencies (#3326), double-register (#3541), mcpServers grant (#3461) | agents / manifest | manifest and loader work that changes what users see in /plugins and the slash menu | plugin validate + a fresh install on the floor version | wave 3 |
| #3763 Finder permission, #3764 strict-mcp-config, #3767 code-review self-start, #3768 OTel attrs, #3771 mcp scope display | none | CC-internal or doc-only; close with the grep that proves no ork surface | one comment each | no-op |
#3765 /cd reloads project config | hooks | doc-only: lifecycle/cwd-changed is where a cwd-scoped refresh belongs; README already updated in #3791 | none | doc |
type: prompt hooks in wave 2?The #3770 audit found every stdout writer JSON-only, so the earlier "audit first" condition is met.
experimental.cacheTtl: "1h" go?--restricted smoke run live?