Orbit  /  how it works  /  for review

One human, many agents, one memory.

Orbit is a self-hosted control layer for AI coding agents. This page explains how the pieces fit together, and the one piece that's missing โ€” a knowledge folder that lives in the repo and keeps itself current.

The problem

Every session starts from zero. Nothing an agent learns survives it.

An agent works out why a migration deadlocks on Tuesday. Thursday โ€” same project, maybe a different agent โ€” that reasoning is gone. It gets re-derived, or the same dead end gets walked again.

  • Rediscovery โ€” context rebuilt from scratch every session, paying the same cost again.
  • Repeated mistakes โ€” failed approaches are a session's most valuable output and the least likely to be kept.
  • No project story โ€” work is scattered across sessions, branches and machines, so nobody can see the arc.

Why it persists: three memory stores that can't see each other โ€” Claude Code's, Codex's, and Orbit's โ€” two of them vendor-private. And the usual fix, a team wiki, dies of neglect.

The fix in one line: capture what every agent does through hooks that already exist, compile it once into shared project knowledge, and hand it back at the start of every session. The maintenance that kills human wikis is exactly the work a model does for free.

Graph 1

The cast

Five moving parts. Four exist today; the fifth is what's being proposed.

Human

Sam

One operator, several machines. Mostly on a phone, via Telegram.

Personal agent

Hermes

Always-on assistant reachable on Telegram. Runs a PM profile per project that triages, proposes work, and asks Orbit to dispatch it.

Control layer

Orbit

Mission control and system of record. Watches every session, ranks what needs attention, dispatches work, holds the state.

Workers

Coding agents

Claude Code and Codex CLI. Do the actual work, each in an isolated git worktree.

Reading surface

Obsidian vault

Markdown notes โ€” the human-readable layer where Sam reads plans, tasks and knowledge.

Proposed

The docs/ folder

The project's own knowledge, living in the repo and versioned by git. The shared memory every project is missing โ€” everything below is about filling it.

Graph 2

How they work together

One task, start to finish. Each step is done by a different player.

01

Ask

Sam messages Hermes on Telegram โ€” "get the deploy blocker fixed".

Sam โ†’ Hermes

02

Plan

That project's PM agent checks state, picks the task, and asks Orbit to dispatch it.

Hermes PM โ†’ Orbit

03

Build

Orbit starts a coding agent in its own worktree, so parallel runs never collide.

Orbit โ†’ Claude / Codex

04

Capture

As it works, hooks stream what happened back to Orbit โ€” plans, tasks, progress, blockers.

Coding agent โ†’ Orbit

05

Compile

Orbit turns that raw evidence into project knowledge, and writes the human view into Obsidian.

Orbit โ†’ knowledge + vault

06

Know

Sam gets progress and approval requests on Telegram. The next session opens already knowing all of this.

Orbit โ†’ Sam, and โ†’ next agent

step 06 feeds step 01 โ€” the loop closes, and each pass starts better informed than the last

Graph 3

Inside step 04โ€“06: how knowledge is made

The proposal itself, on one page. One rule shapes it: agents write evidence, one compiler writes knowledge โ€” and the compiler only runs on main, after a merge.

Orbit
Architecture / knowledge

๐Ÿ›ฐ orbit

Project knowledge, end to end.

Raw sources / immutable read, never edited

claude sessionscodex sessions dispatched runsagent memory files git history
captureglobal hooks record what happened โ€” continuously, and never into your repo

Evidence log / append-only added to, never rewritten

what happenedwho claimed it plans + decisionsgaps are detectable
compile โ€” on merge to mainthe branch lands, and one writer folds the evidence into pages

docs/ โ€” the project's knowledge written by the compiler, versioned by git

index.mdread first, every session
status.mdtasks, as of this merge
decisions/what was chosen, and why
timeline/what happened, in order

cross-references, maintained by the compiler

Live state lives elsewhereAnything changing by the hour โ€” task status right now, blockers, approvals โ€” is asked of Orbit directly. These pages are stamped with the merge they reflect.

The policy

  • personal or work โ€” and what that permits
  • who may contribute, who may publish
  • how complete a page must claim to be
  • what an agent may never assert about itself

Enforced by Orbit at every step โ€” not a convention agents are asked to honour.

โ† governs the pages

briefsevery session opens already knowing
feeds backwhat this session learned

A session

agent startsโ†’ reads index.mdโ†’ opens the pages it namesโ†’ worksโ†’ leaves evidence

Lint / a periodic pass / keeps the pages honest

find contradictionsflag stale claims state what's missingfix broken links

Captured by hooks, compiled at merge, versioned by git, read by every agent, kept honest by lint.

Why merge-to-main is the moment. It's not just tidy โ€” it's the correctness gate. Knowledge about code that never merged never becomes truth, and because the compiler only ever runs on main, two agents on two branches can't fight over a page. The thing that made this hard โ€” work stranded on branches that never land โ€” stops being possible.

Graph 4

Inside the compile

What actually happens when a branch lands. The useful idea here is borrowed: documentation as a build artifact โ€” kept current by infrastructure, not by anyone's discipline.

Orbit
Pipeline / compile

๐Ÿ›ฐ orbit

Knowledge as a build artifact.

A merge to main the only trigger

the code that landedthe evidence behind it
read what landedthe change itself
1

The diff

what changed in the repo
files touchedtests added or broken migrationsnew entry points
then deeperthe part no scan of the code could recover
2

What happened while doing it

why it was done that way
session evidenceplans + revisions task transitionseach agent's memory files what failed first
split across writersone facet each โ€” and only one of them needs judgment

Writers one page each, just enough context

no modelstatusrendered from the task data, byte-identical if nothing changed
no modeltimelineappended from the event log, in order
no modelindexregenerated from what exists
needs judgmentdecisionswhat was chosen and why, what was rejected โ€” the only page an LLM writes

docs/ committed on main, reviewable in a pull request

index.mdstatus.md decisions/timeline/

Currency as infrastructure

merge to mainโ†’ compile runsโ†’ docs committed orbit compile

Built from what landed and what happened, split across writers, kept current by the merge itself.

Where this differs from documenting a codebase. A tool that reads only your source can regenerate its output at any time โ€” nothing is ever lost. Three of the four writers above work like that. But why an approach was rejected is not in the code, and no future scan will recover it. That page is accumulated, never regenerated โ€” which is why the evidence log exists at all.

Graph 5

What's actually in docs/

Every project gets the same page set โ€” only the values differ. That's what makes it possible to ask one question across all of them at once. Standard templates organise by topic; this one organises by how each page stays true, because that decides who may write it and what a stale page means.

RegimeStays true byWritten byA stale page means
DerivedRegenerated from code or data every compilemachine, no modela bug โ€” it should have regenerated
DecidedSuperseded explicitly by a later decisionmodel, from evidencea missing decision record
DiscoveredNever โ€” it's dated, and that's the pointappend-onlynothing. It's history, not status

The page set:

PageRegimeAnswers
index.mdderivedwhat exists here, and how to read it
status.mdderivedtasks, blockers, next โ€” stamped with the merge
architecture/overview.mddecidedwhat shape this system is, and what forced it
architecture/backend.mdmixedlanguage, organisation, background work ยท + derived module inventory
architecture/frontend.mdmixedrendering approach, state, build ยท + derived route inventory
architecture/data.mdmixedstores, migrations, backup โ€” and when restore was last tested ยท + derived schema
architecture/api.mdmixedstyle, versioning, errors ยท + the derived endpoint inventory
architecture/deployment.mdmixedwhere it runs, how a change reaches prod, how it rolls back ยท + derived pipeline
architecture/security.mddecidedwho can do what, secrets, trust boundaries, accepted risks
architecture/observability.mdmixedhow you'd know it broke ยท + derived alert inventory
decisions/NNNN-*.mddecidedone decision each โ€” context, choice, alternatives rejected, consequences
research/YYYY-MM-DD-*.mddiscoveredspikes, benchmarks, dead ends โ€” the question, the numbers, the verdict
timeline/YYYY-MM.mdderivedwhat happened, in order, from the event log

Same schema, different values. Each architecture page carries typed frontmatter from a fixed vocabulary โ€” so one query answers across every project at once:

FieldPick from
stylemonolith ยท modular-monolith ยท microservices ยท serverless ยท event-driven ยท local-app ยท library ยท cli ยท hybrid
runtimebare-metal ยท vm ยท container ยท k8s ยท paas ยท faas ยท edge ยท on-device
api.stylerest ยท graphql ยท grpc ยท trpc ยท websocket ยท mcp ยท none
frontend.stylessr ยท spa ยท ssg ยท islands ยท native ยท tui ยท none
data.storerelational ยท document ยท kv ยท graph ยท vector ยท file ยท none
authnone ยท session ยท jwt ยท oauth ยท api-key ยท mtls
deploy.strategymanual ยท rolling ยท blue-green ยท canary ยท immutable
envslocal ยท dev ยท staging ยท prod

More than one value is often correct โ€” a public rest API alongside internal trpc is a normal shape, not a contradiction. And extending a vocabulary is itself a decision, so it gets an ADR.

Two rules that make it trustworthy. A page that doesn't apply โ€” deployment for a CLI tool โ€” says applies: false with one line of reason, because an empty page is ambiguous: not-yet-written and not-applicable look identical, and an agent can't tell them apart. And an accepted decision is never edited to say something different โ€” a new one supersedes it. Having believed something is itself information.

Graph 6

Where knowledge lives today โ€” and what each store is for

One store is the truth: the project's own docs/ folder. Everything else is either something we read, or a copy we write out. Git provides the versioning, the history and the review โ€” so there's no second knowledge database to keep in step.

StoreWhat's actually in itOwnerIts job
docs/ in the repo the truth What happened, task status as of this merge, what's next, and what was tried and rejected. Plain markdown, committed with the code. compiler writes
git versions
The source of operator truth. Every agent reads it, every agent feeds it, and it travels with the repo โ€” clone the code and you have the knowledge.
Claude Code memory
~/.claude/โ€ฆ/memory/
An always-loaded index plus one small file per fact, written automatically at session end. vendor Read as raw material. Harvested at merge time, never edited. Keeps working exactly as it does now.
Codex memory
~/.codex/memories/
A global store โ€” a registry, a summary injected into every session, and one file per past session tagged with the folder it ran in. vendor Read as raw material, filtered to this project by that folder tag.
Orbit Live task status, blockers, dispatch, attention โ€” plus the buffer of evidence waiting for the next merge. Orbit The pipeline and the live state. Not a second knowledge store: it holds what's happening right now, and stages what hasn't been written to docs/ yet.
Obsidian vault A nightly mirror of every project's docs/, alongside Sam's own notes and the cross-project view. human + mirror The reading surface โ€” one place to browse everything, and a backup. Delete it and nothing is lost.

Two things live in Orbit rather than in docs/, on purpose:

Live status Tasks change state hourly; merges happen weekly. The docs/ status page is stamped "as of merge abc123" and is honest about that. Anything needing real-time state โ€” the dashboard, dispatch, phone approvals โ€” asks Orbit.
Work projects Client repos can't be written to at all โ€” not one file. They get the identical pipeline, but knowledge is published to Orbit and the vault instead of a docs/ folder. Same machinery, different destination.

What this simplification removes. An earlier draft kept versioned knowledge inside Orbit and synced copies out to each machine. Git already does versioning, history, diffing and review โ€” so that whole layer is gone, along with the sync protocol, the local cache, and the question of what happens when two machines edit the same page. Pull requests answer it instead.

Graph 7

Who is responsible for what

The design works because each player has a narrow job and an explicit list of things it may not do.

Hermes โ€” per-project PM agent

Decides what should happen

  • Reads project state and triages what matters now
  • Proposes tasks, plans and note edits for approval
  • Asks Orbit to dispatch work to a coding agent
  • Handles blockers first โ€” escalates to Sam only when it genuinely needs him
  • Reports progress and approval requests over Telegram, respecting quiet hours

May not: authorise its own dispatch, publish knowledge directly, or decide how much a claim is trusted.

Orbit โ€” control layer

Records, decides authority, publishes

  • Holds the system of record: events, tasks, snapshots, knowledge
  • Watches every session on every machine and ranks what needs attention
  • Dispatches runs exactly once, in isolated worktrees
  • Assigns trust levels โ€” an agent's claim is always recorded as a claim
  • Enforces personal/work policy on every operation
  • Runs the compiler and publishes versioned knowledge

May not: write anything inside a repository, or trust a trust-level an agent asserted about itself.

Claude Code ยท Codex CLI

Do the work, and leave a trail

  • Receive a short project briefing automatically at session start
  • Query Orbit mid-session for status, tasks and past decisions
  • Work in their own worktree โ€” parallel runs never collide
  • Emit evidence continuously through hooks, with no cooperation required
  • Optionally file an explicit note: "this approach failed, here's why"

May not: edit published pages, touch another project, or modify your instruction files.

Sam

Sets direction and approves

  • Asks for work in plain language, usually from a phone
  • Approves anything that changes a repo, and every work-project publication
  • Classifies a project as personal or work โ€” once, and it sticks
  • Reads the vault when he wants the long view

Never has to: paste context, maintain a wiki, or tell one agent what another already learned.

Graph 8

When the docs get written

Evidence is captured continuously, but docs/ is only rewritten at moments where the work is settled. Three triggers, in order of how much they matter.

Primary

On merge to main

A branch lands. A hook fires, and the compiler reads everything that happened on that work โ€” evidence, plans, both agents' memory files โ€” and updates docs/ in one commit.

the correctness gate

Catch-up

Nightly

Not everything merges. Exploratory sessions, abandoned branches, research, long-running work โ€” a nightly pass folds in whatever the merge trigger missed.

so nothing is lost

On demand

When asked

Sam or a PM agent can ask for a refresh โ€” before a review, after a big change, or when the status page is visibly behind.

manual

evidence is recorded the moment it happens ยท docs are rewritten when the work settles

Graph 9

How two agents work the same project without colliding

Three agents can run on one project at once, on different machines. Collisions are prevented by construction rather than resolved afterwards.

MomentWhat the agent doesWhy it can't conflict
Session opensReceives the project briefing automatically โ€” no lookup, no promptRead-only, from a local copy
While workingAsks Orbit questions โ€” current status, open tasks, past decisionsRead-only, and always answered from one source
Makes changesEdits code in its own isolated checkoutNobody else is in that checkout
Learns somethingAdds a new entry to the shared log โ€” never edits an existing oneAdding can't overwrite; two agents adding at once is fine
Session endsIts evidence is already recorded, whether or not the branch is ever mergedKnowledge leaves by a route that doesn't depend on merging
LaterNothing โ€” the compiler folds everything inOne writer means no page ever has two authors

The whole trick: agents only ever add, and only one component ever rewrites. Everything else is a copy that can be thrown away and rebuilt.

Graph 10

Onboarding a project

Two commands total. One per machine, one per project โ€” and the repository is never touched.

Once per machine

orbit setup

  • Installs session hooks for both Claude Code and Codex, globally
  • Registers Orbit as a tool provider for both
  • Starts the background sync so knowledge is on disk before it's needed
  • Backs up and merges any settings you already have โ€” never overwrites

One prompt you can't avoid: Codex asks you to trust the hooks. That's deliberate on their side.

Once per project

orbit project init .

  • Works out a durable identity for the repo โ€” not its folder name, which collides and changes
  • Classifies it personal or work from your path rules; asks once if it's ambiguous
  • Registers it, fetches its knowledge, builds a first snapshot
  • Optionally: creates its Telegram group and turns on the docs/ export

You can skip this โ€” an unknown repo is noticed on the next session and offered for setup.

Every session, automatically

Nothing to run

  • The hook works out which project this folder belongs to, worktrees included
  • Reads the already-synced local copy โ€” no waiting on the network
  • Hands the agent a short briefing: status, open work, recent decisions
  • Records the session as it goes, and closes the loop at the end

What that actually installs, and where:

LocationWhat lands thereReversible?
Claude's global settingsA few hook entries, merged into what's already thereyes โ€” backed up, and removable in one command
Codex's global settingsThe same hook entries, in Codex's formatyes โ€” same
~/.orbit/The event queue, the local knowledge copy, configyes โ€” delete it and it rebuilds
Orbit's databaseLive task state, and evidence waiting for the next mergethis is the operational state โ€” it's what gets backed up
A personal repositoryOne docs/ folder โ€” the knowledge itself, committed and reviewable. Nothing else: no config edits, no instruction files, no hooks in the repo.yes โ€” it's just markdown in git
A work repositoryNothing. Not one file. Knowledge for these lives in Orbit and the vault.n/a

Why the split: half these projects are client work, where writing anything into the repo is unacceptable โ€” so those keep a zero footprint and publish elsewhere. Personal projects get the better deal: the knowledge lives with the code, versioned by git and reviewable in a pull request like any other change.

Status

What already runs, what doesn't

The substrate is in daily use and covered by 645 tests. The knowledge layer is entirely unbuilt.

PieceState
Hooks capturing every Claude session (~7,856 events so far)running
Event log with dedup and secret quarantinerunning
Dispatch to Claude and Codex, with worktree isolation and phone approvalsrunning
Obsidian vault, search, nightly maintenance passrunning
Per-project Hermes PM agentsrunning
Same capture for Codex as for Claudeto build
The compiler, and docs/ written on merge to mainto build
Session-start briefing, read from docs/ on diskto build
Completeness contract โ€” pages that admit what they're missingto build

Two rules that shape everything

Constraints

Work projects are untouchableEvery project is tagged personal or work. Nothing is ever written inside a work repository โ€” not a file, not a config line. So the knowledge has to live outside the repo.
Agents work in isolationDispatched runs happen in separate git worktrees. Anything written inside the repo only reaches the main branch if that branch gets merged โ€” and abandoned branches are kept, not deleted. So knowledge must leave by a route that doesn't depend on merging.

If you're reviewing this

What would help most

Four questions, in priority order

  1. Single compiler โ€” bottleneck or single point of failure? One component publishes all knowledge. It's the only place LLM judgment sits on the critical path.
  2. Can a page be trusted? Every page reports how complete it is, not just how fresh. Is that enough to stop an agent acting confidently on partial knowledge?
  3. Does it hold under concurrency? Several agents, several machines, same project. Evidence is append-only and only the compiler publishes โ€” does that actually remove the conflicts?
  4. Is any of it over-built? This serves one person and a couple of collaborators. Point at anything that's solving a problem this scale doesn't have.

Detail

Where the specifics live

This page is deliberately high level. The full architecture โ€” content-class conflict policy, the authority model, the completeness fields, identity resolution, the 7-phase rollout, and the four corrections a prior review forced โ€” sits in the decision register and the plan document.

QuestionShort answer
Who can publish knowledge?Four capabilities: view ยท contribute evidence ยท publish (curator) ยท set policy (admin). Contributors never publish.
What if two agents write the same thing?Mostly impossible by design โ€” evidence is create-only, published pages have exactly one writer, caches are one-way. Only drafts need conflict handling.
How does a page prove it's current?It carries the snapshot it reflects, how far each source was read, how many events are unprocessed or quarantined, and a plain verdict: complete, degraded, or unknown.
Who decides how much to trust a claim?Orbit does, never the agent making it. An agent's claim is always recorded as "claimed"; only a human or verified system can promote it.
Does this touch my repo's config files?No. Instruction files stay human-owned and hooks are installed globally, never in the repo. The only thing written into a personal repo is the docs/ folder itself โ€” and nothing at all into a work repo.