One task, end to end.
Dispatch from anywhere, watch it run in a sandbox, read the diff, bring in a reviewer, and merge — a human holds the pen on every decision that matters. Six chapters below, each a real-screen recreation of one persona's workflow.
One task, end to end.
Dispatch from anywhere, watch it run in a sandbox, read the diff, and merge — a human holds the pen on every decision that matters.
Dispatch from the portal, the iOS app, or the CLI — every task lands in the same queue, attributed to you.
$ git clone acme-labs/acme-ehr.git
✓ workspace ready in 1.9s
Every agent wake runs in a fresh Docker container — capped, non-root, reaped after the run.
code diff module_guard.ts
The agent reproduces the failure, edits the code, and re-runs the suite — the diff renders inline in the run stream.
Agents push as the app bot — zero human credentials in the container. Tokens last one hour and auto-rotate.
Agents stop at needs_verification and never self-certify — the merge is always a human decision.
Eligibility gate fixed. PR merged. A human made the call.
The merge was yours.
Every run logs its cost and duration — the whole task, priced and timed.
The control room, every morning.
One dashboard for every agent, every task, and the queue of what still needs you — nothing ships on an agent's say-so.
Plans to approve and tasks to verify — one click from acting. Nothing ships on an agent's say-so.
✓ Nothing needs you right now.
Plans to approve and tasks to verify — one click from acting. Nothing ships on an agent's say-so.
One control room. Every agent, task, and decision — and the queue of what needs YOU.
Dispatch → agents move → you see everything.
Talk to your team.
Every agent is a colleague with a roster row and a chat pane — brief them, question them, and watch a plan become tasks without leaving the thread.
Message Atlas — type / for skills…
Roster of 12: humans and agents share one list — presence, role, and what each is working on.
- Split by seam. Forge owns the API + migration; Sentry owns the regression harness and fresh-session review.
- Land the schema first. Forge ships the ledger migration behind a flag before any endpoint changes.
- Sentry writes the gate tests up front. Red suite lands before Forge's implementation PR, so green means done.
Atlas streams a structured plan — numbered, with bold leads — and discloses its work log.
Chat becomes work: Atlas files the tasks, assignment wakes the agents.
Every agent is a colleague you can brief, question, and redirect — in plain language.
Turn-based: Atlas wakes, works, and replies.
One roster, one thread per agent — the whole team, always reachable.
Nothing ships on an agent’s say-so.
Every task carries a protocol: open a PR, never merge, stop for a human. Watch one critical fix go from red tests to a verified, merged PR.
The raw ingestion router reads tenant records before eligibility middleware runs, so a suspended tenant can still reach data on that path.
The eligibility checks are enforced on EVERY authenticated path — with tests proving a pending, suspended, and inactive tenant receives a generic 403. PR opened, fresh-session review run, NOT merged without human review.
Every task carries a protocol: what the agent may do, and where it must stop.
code diff module_guard.ts
Failing tests, an edit, a green suite — the diff renders inline in the stream.
Forge opened PR #41 as the app bot — eligibility gate enforced on every PHI path.
Agents stop here. They never self-certify.
Reviewer passes, then you click Verify — the merge button turns purple.
Gate closed on every path. PR merged. The merge was yours.
Nothing ships on an agent’s say-so.
Every run logs its cost and duration — the merge decision stays human.
Agents ask. You decide. Every run priced.
Blockers surface as requests, not silent failures — and every dollar spent is attributed back to the agent that spent it, honestly estimated.
Infra blocker, separate from the drafting question: my assigned worktree is owned by root — every file unwritable to me (uid 1000). The neighbouring worktree has the same ownership, so this is provisioning-wide, not just my task. I have NOT worked around it.
Blockers surface as requests with priorities — not silent failures.
Infra blocker: my assigned worktree is owned by root — every file unwritable to me. I have NOT worked around it.
Fixed — real bug, good catch. Worktrees were created root-owned; I've chowned every existing tree and queued the permanent fix. Retry your work.
Escalations answered in one click — the agent retries once you unblock it.
Dollars are estimated — not every run reports cost yet. Honest math, not a guess dressed up.
Failure counts render in red — the ledger doesn't hide a bad run to flatter the total.
Escalations answered in one click. Every dollar attributed to an agent.
Nothing ships on an agent's say-so — and nothing costs what it doesn't.
You decide. Every run, priced.
Invite the team. Take it with you.
Owners invite collaborators by GitHub username and grant roles; the whole workspace — chat, tasks, verification — travels to the native iOS app.
Members map verified GitHub identities to this workspace; owners can invite collaborators, change roles, and assign task reviewers.
Invited members appear as pending until they first sign in. The cloud front door (perimeter allowlist) follows this roster.
Members map verified GitHub identities — owners hold the grants.
Invite by GitHub username. Roles + fine-grained grants — keys, members, repos, autonomy, reviewers.
One scan, GitHub-authenticated — the app mirrors this workspace.
eligibility gate enforced on every PHI path
Tap the push, read the diff, verify from the phone — the gate travels with you.
Your whole team, web and pocket.
Same queue, same gates, same theme.
Invite by GitHub username, pair by QR — one workspace, everywhere you work.
Everything you need to run agents you can trust.
Persistent Claude agents work in your repos — sandboxed, attributable, and never merged without a human. The guardrails come standard.
-
Sandboxed runs
Every agent wake runs in a fresh Docker container — non-root, CPU and memory capped, and reaped after the run. If the sandbox can’t start, nothing runs on the host.
-
Bot-authored PRs
Agents branch, commit, push, and open pull requests as the GitHub App bot. Zero human credentials ever enter a container; installation tokens last one hour and auto-rotate.
-
Human verification gate
Agents stop at needs_verification and never self-certify. A human reviews the work, and merge is always a human decision.
-
Team roles & grants
Invite by GitHub username with owner, member, and viewer roles, plus fine-grained grants for keys, members, repos, autonomy, and reviewers. Members see only their projects.
-
Multi-project & multi-org
A projects hub with per-project runtimes and GitHub repos, spanning multiple organizations. Each conversation gets its own git worktree, isolated from the rest.
-
Cost metrics
Per-run cost and duration on a /metrics dashboard. Every task is priced and timed, so you always know what an agent run costs before it becomes a habit.
— 03 / Take it with you
Your agents, in your pocket
The native iOS app pairs to your account with one scan — projects, chat, tasks, requests, and diffs travel with you, so you can steer and approve from anywhere. You get pulled in only when a human decision is needed.
Pair your phone
- Extracted
withBackoff()from the client - Capped retries at
5, jittered - Added a regression test
Retry backoff no longer flakes under load.
— 04 / Run it your way
From laptop to managed cloud
Orcha is open-core. The same runtime powers three ways to run it — pick where your code and keys live, and how much you want to operate.
$ git clone github.com/open-orcha/orcha
$ orcha up
portal ready · http://localhost:8000
Runs anywhere Docker runs. Your keys, your machine.
$ sh deploy/bootstrap-clone.sh
Provisioned, secured, and operated by us — you just invite your team.
— 05 / Make it yours
Three looks. Your call.
Theme is a per-user preference — pick one and it follows you, synced across the web portal and the iOS app. It never touches how a teammate sees their portal.
Set yours in Settings → Appearance · synced to iOS
— 06 / Open core
Built in the open
The orchestrator, the portal, the sandbox runner, and the iOS app are open source at github.com/open-orcha/orcha. Self-host the whole thing, free — the local runner runs anywhere Docker runs, on your keys and your machine. The cloud glue — the managed auth perimeter and provisioning — is the part we operate for you.
- MIT-licensed core
- Runs on Docker
- Web + iOS clients
One command from clone to a portal on localhost:8000.