🧭 Two users, one morning: the plan, drawn
OrchestKit, 2026-08-31. Yotam's voice note and Nir's screenshot go first; the adoption backlog follows in the order that avoids conflicts. Eleven lanes, three defaults you can flip at the bottom.
🔥 Superseding order: the divergence purge
Operator, 11:15: remove every hook a CC-native mechanism replaces, fully, one push. Built by 13:30: six PRs, one merged, five in the strict-checks merge train; the hq-ext leg (hq-ext-plugin#1187) shipped four PRs of its own. Measured on the way: the 26 deny rules ork ships in its plugin settings were NEVER enforced (CC reads only two keys from a plugin settings file), so the hooks are the only live protection and the purge must ship a vehicle first.
| PR | what | ends |
|---|---|---|
| 1 · #3836 merged | vehicle: /ork:setup writes real operator-scope deny rules + sandbox block, with consent; doctor proves they enforce | the never-enforcing JSON |
| 2 · #3837 | register: verdict per hook in cc-native-first.md | #3629 (out of scope) |
| 3 · #3838 | delete dead 4, compound-command-validator, agent-browser-safety | silent dead weight |
| 4 · #3839 | delete egress ASK tier, cron-guard, team-size-gate, restrict-bash; pre-commit-runner moves to git hooks | Yotam's and most of Nir's prompts |
| 5 · #3840 | security baseline amended, then file-guard + credential-read-guard deleted (after the enforcement probe is green) | |
| 6 · #3841 | delete git-validator + dangerous-command-blocker; security suite becomes tripwires on the NATIVE mechanism | the parallel permission system |
CC's own rules, sandbox and prompts do the guarding; ork keeps only what CC cannot see (secret bytes, executing fetched code, budgets, spend consent). Lanes 0a/0d below are superseded; the backlog lanes wait behind the purge.
29 hooks keep re-asking what CC already decides, and users keep switching everything off.
🗺 What changes where
Left: the Claude Code session, where hooks watch tool calls. Right: the repo, where automation and paperwork live. Green boxes are new.
every browser path a hook can see shares one policy; every egress ask carries its own remedy; conflicting PRs heal themselves.
three engines stay unguarded, the ask stays a mystery, and every hooks PR keeps needing a manual rebase.
🔢 The order, and why
User-facing first. Paperwork next (no build). The re-derive workflow lands before the browser PR so that PR does not conflict within a day.
red = user-facing, blue = paperwork and closes, green = code PRs with a Lab playground each.
the hooks PR (Lane 3) lands first and gets re-conflicted by the next merge, again.
🔇 Lane 0a: Yotam, "it stops me every time" user
The egress guard asks "Uploads data to a non-allowlisted host. Proceed?" for every scp, rsync, or upload to a host it does not know. His private server is unknown. Overnight there is nobody to answer. Nir hit the same wall wider: "Yes or No every few minutes since early August", "I did not understand what I had to approve", and both users ended up running with permissions off.
| what | today | after |
|---|---|---|
| the ask text | "Proceed?" | "add host to sandbox.network.allowedDomains, or ORCHESTKIT_EGRESS_ALLOWLIST=host" |
| allowlist sources | 14 built-ins + an env var nobody can find | plus sandbox.network.allowedDomains from the four settings files, even with the sandbox off |
| the unattended case | silent hang | next session start: "last session asked 6x: egress guard (host X: one settings line), command blocker 2x (no knob, answer per case)"; one digest for all 8 hooks that can ask |
one line in .claude/settings.json and the asks stop; the prompt itself says which line. Until this ships, the env var is the only knob that works today; the reply draft to Yotam says so.
he keeps running with permissions off to get through the night, which turns every other guard off too.
🪞 Lane 0b: Nir, the same plugin loaded three times user
Before updating: /ork:expect 8 times. After "Updated ork" and /reload-plugins: 5 times, and the reload line says 7 plugins, 248 skills, 79 agents, 307 hooks. ork is 106 skills and 36 agents, so at least two full copies are loaded. Reproduced here in an empty config dir, no spend:
| install | rows per command | why |
|---|---|---|
ork@orchestkit alone (stable, v9.8.0) | 2 | 35 command wrappers still shipped on stable (#3541; removed on main by #3807) |
plus ork-alpha@orchestkit | 3 | both entries install plugins/ork, both named ork, CC does not dedup |
| Nir, after update | 5 | fits 2 + 2 + 1: a third copy (older cache via a second settings scope) not yet updated; his claude plugin list settles it |
a GA release drops stable to 1 row; a session-start notice says "N copies of ork are loaded, uninstall X"; the README says pick one entry, never both; CC gets an upstream dedup request.
every stable user sees 2x forever and anyone who tried alpha sees 3x or more.
🧨 Lane 0d: a delete nothing watched user
On 18/08 Nir's agent ran find deploy/schema -name '*.sql' -size 0 -delete. A tracked SQL file was size 0, so it went, and the deploy broke. No guard has any find -delete or -exec rm pattern.
the command blocker asks first: "find with -delete removes every match, including tracked files; run it without -delete and read the list". In bypass mode it says so instead of asking.
the next size-0 tracked file goes the same way, silently.
📋 Lane 0e: the rest of Nir's month, with owners user
From his 1:1 chat and five recorded calls. Only the ork-shaped items get work here; the others get a named owner.
| item | owner | here |
|---|---|---|
| duplicate issues, duplicate work across two windows, "decision badly overdue" nudge (19/08) | herdr / platform (the string is not ork's) | hand over |
| plugin 4 versions behind, wants one "Update all" (23/08) | Claude Code owns /plugin update | session-start notice names the command |
| two CLAUDE.md files to keep in sync (23/08) | project setup | none |
| Windows terminal and ssh-per-server friction (20/08, 23/08) | onboarding docs | none, mentioned in the reply |
| agent advised deleting an Ops Apps folder (31/08) | agent advice, not a tool call | Lane 0d covers the tool-call side |
| "the thing I actually use on our RemoteICU every day" (27/08) | quoted back |
each complaint has one owner and the ork ones are in lanes 0a, 0b, 0d.
the same list comes back on the next call.
📌 Lane 1: the epic that says "3 of 5 pinned" paperwork
EPIC #3309's progress comment counts two pins that exist only in a generator nobody ran on this tree. Apply the generator, re-measure, close with the true five-row table.
tracked / generator-applied / runtime-read / CC-owned / doc-only, one per row, no prose counted as adoption.
the epic closes on a comment the ledger already caught twice as wrong.
📰 Lane 2: 27 platform capabilities, 3 issues paperwork
21 already have verdicts (3 adopted, 4 later, 14 declined). Six are open: the Python SDK v1.0 (one real finding: anthropic>=0.40.0 floats across a major) and five that are not applicable to a plugin.
one audit file in the shape the CC lane already uses, three closing comments with the measurement, watcher untouched.
the three issues stay open and the next watcher run adds a fourth.
🔁 Lane 5a: PRs that heal their own conflicts code
Committed bundles must stay (installs read them from git, main is locked). So a workflow on every push to main rebases PRs whose only conflicts are generated files, rebuilds, and pushes. The same recipe run by hand three times in two days.
a conflicting PR gets CI again within minutes instead of silently getting none.
34 dist commits in 14 days keep every open hooks branch conflicting within a day.
🌐 Lane 3: four browser engines, one policy code
Only the Bash path is guarded today. Anthropic's API toolset cannot be seen by a plugin at all: declare it out of scope. The two MCP paths can be seen: wrap them.
| engine | seen by a hook? | after |
|---|---|---|
| agent-browser CLI (Bash) | yes, but $url tokens slip through | shell expansion asks, never silently allowed |
| agent-browser --mcp (153 opens logged) | no | browser URL guard |
| claude-in-chrome (39 navigations logged) | no | browser URL guard |
| browser_toolset_20260801 (Messages API) | impossible | out of scope, stated in the skill and pinned by a test |
blocklist, rate limit, robots and canonical URL form live in one module both guards call.
three of four engines stay invisible to every blocking hook.
✅ Lane 4 and 5b: record what was measured, tidy two rows paperwork
"Which guards become prompt hooks?" was measured on 08-29: the regex guards were right 142/142 and 23/23, the prompt hook 129 and 22, at 5 seconds a call. Answer: none. Cache TTL already shipped on 5 agents; the restricted lane already runs in CI.
wave 2 closes with numbers; the stale 2.1.219 queue row goes; #3462 gets the checklist it never had.
an answered question keeps blocking a wave on the architecture page.
🎛 Three defaults, flip any of them
The plan runs with the first option of each unless you change it here and paste the bar.