> ## Documentation Index
> Fetch the complete documentation index at: https://orbit.nckrtl.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Architecture decisions

> Every architecture decision record behind Orbit, with its status and the records it extends or amends.

The documentation is the single source of truth for Orbit's current architecture, components, behavior, and boundaries. An architecture decision record (ADR) holds a decision only while the decision is being built. The pull request that completes the decision writes it into the owning documentation page and retires the record. The [ADR guide](https://github.com/nckrtl/orbit/blob/main/docs/decisions/README.md) describes the steps.

Records lists the decisions in progress. Retired decisions lists every retired number and the page that now holds the decision.

## Decision lifecycle

The docs-first subtask writes an ADR when a feature needs an architectural decision, alongside the documentation that describes the intended behavior. A new ADR says `In progress.` in its Status section and names the [mission principle](/docs/mission#principles) it serves. If the decision needs an exception to a principle, its Principle line names that principle and explains the exception and its reason. The ADR and documentation are the contract for implementation.

The pull request that completes a decision writes its behavior into the owning page and its lasting reasons and rejected alternatives into that page's "Why it works this way" section. It deletes the ADR, removes it from Records, redirects the exact ADR path to the absorbing section, adds a Retired decisions row, and updates inbound links. A decision completed in one pull request never leaves an ADR on main; a record stays only while a decision spans multiple pull requests. Numbers are never reused. The retired table and redirects resolve old numbers and links, including those in code comments.

`composer docs-lint` enforces this lifecycle: retired slugs have no matching file and each has a redirect from its exact path. Live ADRs numbered 0180 or later must say `In progress.` in their Status section and include a `Principle:` line. A lower number follows those same two rules only when Retired decisions does not list it. The open gaps are 0007 and 0020. The committed allowlist for older live records can only shrink as those records retire. The [docs-impact check](/docs/contributor-guide#docs-impact-stays-in-the-repository) and `covers:` frontmatter keep pages in step with code between decisions.

## Why it works this way

Permanent ADRs made the current rule hard to find: amendments spread it across historical records, and built decisions still marked `Proposed.` misled readers. Domain pages now own the present behavior, while Git keeps the full history. Keeping superseded records would leave the same growing list and link chains; retiring them in periodic batches would leave documentation behind the code. Absorbing each decision in the completing pull request lets reviewers check the behavior, rationale, and redirect together. Keeping only the reasons that still matter in the owning page makes the documentation useful without requiring readers to reconstruct an ADR chain. An exact retired slug, rather than just its number, preserves the identity of older paths even when historical records share a number.

## Records

| Record | Decision | Status |
| - | - | - |
| [0182](/docs/decisions/0182-start-tasks-from-project-task-definitions) | Start tasks from Project task definitions | In progress; amends [0178](/docs/reference/tasks#project-owned-task-policy) |
| [0190](/docs/decisions/0190-run-mysql-servers-with-a-gateway-held-admin-password) | Run MySQL servers with a Gateway-held admin password | In progress |
| [0191](/docs/decisions/0191-clone-the-default-instance-database-for-each-new-instance) | Clone the default Instance's database for each new Instance | In progress |
| [0196](/docs/decisions/0196-derive-application-directory-from-web-root) | Derive the application directory from the web root; serve more web roots through Routes | In progress |
| [0198](/docs/decisions/0198-keep-delivery-line-proofs-as-repo-commands) | Keep delivery-line proofs as repository commands | In progress |
| [0200](/docs/decisions/0200-run-each-task-group-in-its-own-sandbox-vm) | Run each task group in its own sandbox VM | In progress |
| [0206](/docs/decisions/0206-build-task-vm-images-as-chains-of-small-jobs) | Build task VM images as chains of small jobs | In progress; amends [0200](/docs/decisions/0200-run-each-task-group-in-its-own-sandbox-vm) |

## Retired decisions

These decisions are built, superseded, or withdrawn, and the documentation holds what still applies. The link goes to the page that holds each one.

| Record | Decision | Now in |
| - | - | - |
| 0001 | Adopt the closed Tool Management contract | [Tools: Why it works this way](/docs/reference/tools#why-it-works-this-way) |
| 0002 | Keep proof resources task-owned and production separate | [Incus topologies: Exact ownership](/docs/reference/incus-topologies#exact-ownership) |
| 0003 | Adopt the singleton Metrics role contract | [Metrics role](/docs/reference/metrics) |
| 0004 | Define the verify-only Doctor boundary | [doctor: Why it works this way](/docs/cli/doctor#why-it-works-this-way) |
| 0005 | Adopt a rolling Incus development topology (superseded) | [Incus topologies: Composed from role images](/docs/reference/incus-topologies#composed-from-role-images) |
| 0006 | Separate disposable discovery from immutable proof (superseded in part) | [Incus topologies: A live mount](/docs/reference/incus-topologies#a-live-mount) |
| 0008 | Define typed app-dev node storage settings | [Node settings](/docs/reference/node-settings) |
| 0009 | Adopt clustered Instance routing | [Routes: Set up private traffic](/docs/reference/routes#set-up-private-traffic) |
| 0010 | Record decisions before implementation issues (superseded) | [Contributor guide: Decisions ship with their feature](/docs/contributor-guide#decisions-ship-with-their-feature) |
| 0011 | Define clustered production ingress and app-prod placement | [Routes: Publish a public Route](/docs/reference/routes#publish-a-public-route) |
| 0012 | Ubuntu 24.04 operator clients (withdrawn) | [Node provisioning: Add a Node](/docs/reference/node-provisioning#add-a-node) |
| 0013 | Manage schedules with native systemd timers | [Schedules](/docs/reference/schedules) |
| 0014 | Maintain verified documentation as implementation context | [Contributor guide: One documentation corpus](/docs/contributor-guide#one-documentation-corpus) |
| 0015 | Retain Incus proof by recorded-input equivalence (superseded) | [Contributor guide: Review reproduces on a discovery topology](/docs/contributor-guide#review-reproduces-on-a-discovery-topology) |
| 0016 | Reconcile App identity and source-default updates | [Projects: Update a Project](/docs/reference/projects#update-a-project) |
| 0017 | Make Cluster placement optional | [cluster: Placement and TLDs](/docs/cli/cluster#placement-and-tlds) |
| 0018 | Register caller-local development worktrees as Instances | [Applications: Registration takes ownership (superseded by 0027)](/docs/domains/applications#registration-takes-ownership) |
| 0019 | Run disposable Incus scenario lanes (superseded) | [Incus topologies: Composed from role images](/docs/reference/incus-topologies#composed-from-role-images) |
| 0021 | Pin Sury PHP-FPM with OPcache profiles per role | [PHP runtimes: Why it works this way](/docs/reference/php-runtime#why-it-works-this-way) |
| 0022 | Track the issue workspace and delete it before merge (superseded) | [Contributor guide: Review reproduces on a discovery topology](/docs/contributor-guide#review-reproduces-on-a-discovery-topology) |
| 0023 | Separate hostname selection from Cluster routing | [Routes: Why it works this way](/docs/reference/routes#routes-own-domains-and-cluster-membership-owns-scope) |
| 0024 | Make generated Route identity follow its target | [Routes: Why it works this way](/docs/reference/routes#generated-identity-follows-the-target) |
| 0025 | Stabilize the default Instance identity | [Applications: The default Instance keeps its name](/docs/domains/applications#the-default-instance-keeps-its-name) |
| 0026 | Identify each App by one repository | [Projects: Repository identity](/docs/reference/projects#repository-identity) |
| 0027 | Adopt local Git sources into Instance ownership | [Applications: Register an existing checkout](/docs/domains/applications#register-an-existing-checkout) |
| 0028 | Require one Route per active Instance | [Routes: Why it works this way](/docs/reference/routes#one-route-per-active-instance) |
| 0029 | Manage Laravel application URLs through Orbit | [Applications: Laravel application URL](/docs/domains/applications#laravel-application-url) |
| 0030 | Complete Instance provisioning without application health gates | [Applications: Active does not mean healthy](/docs/domains/applications#active-does-not-mean-healthy) |
| 0031 | Clone initial production source during provisioning | [Instance cloning (superseded by 0047)](/docs/reference/instance-cloning) |
| 0032 | Preserve explicit Instance branch selection | [Applications: An explicit branch stays explicit](/docs/domains/applications#an-explicit-branch-stays-explicit) |
| 0033 | Trust WireGuard members for private Node traffic | [Routes: Private network trust](/docs/reference/routes#private-network-trust) |
| 0034 | Select Instance PHP from Composer constraints | [PHP runtimes: Select the PHP version](/docs/reference/php-runtime#select-the-php-version) |
| 0035 | Close out mutating proofs by refreshing the topology snapshot (superseded) | [Incus topologies: Composed from role images](/docs/reference/incus-topologies#composed-from-role-images) |
| 0036 | Support only Instances | [Applications: One application model](/docs/domains/applications#one-application-model) |
| 0037 | Promote fresh three-node topology snapshots (superseded) | [Incus topologies: Composed from role images](/docs/reference/incus-topologies#composed-from-role-images) |
| 0038 | Cascade Instance removal through processes and schedules | [Instance removal: Processes and Schedules](/docs/reference/instance-removal#processes-and-schedules) |
| 0039 | Use round-robin for production Route pools | [Routes: Serve a production pool](/docs/reference/routes#serve-a-production-pool) |
| 0040 | Extend issue proof with one app-prod Node (superseded) | [Incus topologies: Declared Nodes](/docs/reference/incus-topologies#declared-nodes) |
| 0041 | Delete an empty Route during Instance removal | [Routes: Remove a Route](/docs/reference/routes#remove-a-route) |
| 0042 | Provision Tool Managers on demand | [Tools: Managers on demand](/docs/reference/tools#managers-on-demand-independent-of-roles) |
| 0043 | Manage Homebrew Core formulae | [Tools: Homebrew formulae](/docs/reference/tools#homebrew-formulae) |
| 0044 | Own Instance environment configuration in Orbit | [Instance environment variables](/docs/reference/environment-variables) |
| 0045 | Isolate production PHP-FPM by Unix user | [PHP runtimes: Production runtime](/docs/reference/php-runtime#production-runtime) |
| 0046 | Own production release deployment in Orbit | [Production release layout](/docs/reference/deployments) |
| 0047 | Create production Instances from candidates | [Instance cloning](/docs/reference/instance-cloning) |
| 0048 | Copy Project process and schedule definitions into Instances | [Processes and schedules: Production copies](/docs/reference/processes-and-schedules#production-copies) |
| 0049 | Keep delivery artifacts off the merge head (superseded) | [Contributor guide: Review reproduces on a discovery topology](/docs/contributor-guide#review-reproduces-on-a-discovery-topology) |
| 0050 | Release successful proof resources before landing (superseded) | [Contributor guide: Review reproduces on a discovery topology](/docs/contributor-guide#review-reproduces-on-a-discovery-topology) |
| 0051 | Select discovery-only feature delivery (superseded) | [Contributor guide: Review reproduces on a discovery topology](/docs/contributor-guide#review-reproduces-on-a-discovery-topology) |
| 0052 | Seed worktrees from successful main test baselines | [Feature delivery: Main caches come only from clean main](/docs/reference/implementation-loop#main-caches-come-only-from-clean-main) |
| 0053 | Use local review checks for feature landing (superseded) | [Feature delivery: The candidate gate](/docs/reference/implementation-loop#the-candidate-gate) |
| 0054 | Maintain main caches asynchronously | [Feature delivery: Maintenance runs in the background](/docs/reference/implementation-loop#maintenance-runs-in-the-background) |
| 0055 | Restrict Grafana access to authorized Gateway peers | [Metrics role: Grafana access](/docs/reference/metrics#grafana-access) |
| 0056 | Retain proof topologies for interactive review (superseded) | [Contributor guide: Review reproduces on a discovery topology](/docs/contributor-guide#review-reproduces-on-a-discovery-topology) |
| 0057 | Limit Metrics exporters to managed Nodes | [Metrics role: Exporter selection](/docs/reference/metrics#exporter-selection) |
| 0058 | Separate Incus requirements from delivery flow (superseded) | [Contributor guide: Review reproduces on a discovery topology](/docs/contributor-guide#review-reproduces-on-a-discovery-topology) |
| 0059 | Make the Builder own the candidate quality gate (superseded) | [Feature delivery: The candidate gate](/docs/reference/implementation-loop#the-candidate-gate) |
| 0060 | Record the latest Schedule run status | [Schedules: Latest run](/docs/reference/schedules#latest-run) |
| 0061 | Use VPN DNS by default on managed peers | [Private DNS: Resolver selection](/docs/reference/private-dns#resolver-selection) |
| 0062 | Select Cluster Router DNS addresses from LAN intent | [Private DNS: Cluster Router addresses](/docs/reference/private-dns#cluster-router-addresses) |
| 0063 | Prefer active Cluster TLDs for generated Routes | [Routes: Select a domain and scope](/docs/reference/routes#select-a-domain-and-scope) |
| 0064 | Name application endpoints as domains | [Routes: Why it works this way](/docs/reference/routes#domains-and-hostnames) |
| 0065 | Replace Routes when domains change | [Routes: Change an explicit domain](/docs/reference/routes#change-an-explicit-domain) |
| 0066 | Transfer development Instances between Nodes | [Instance transfer](/docs/reference/instance-transfer) |
| 0067 | Serve development servers on the Route origin | [Routes: Development-server endpoint](/docs/reference/routes#development-server-endpoint) |
| 0068 | Accept only apps.path as the node storage setting path | [Node settings: One typed setting](/docs/reference/node-settings#one-typed-setting) |
| 0069 | Allow Process targets of Instance or managed Node | [Processes and schedules: Owners](/docs/reference/processes-and-schedules#owners) |
| 0070 | Keep the database role as a Docker baseline | [Database role](/docs/reference/database-role) |
| 0071 | Use one verb vocabulary across the CLI, route names, and SDK | [CLI command vocabulary: Why it works this way](/docs/reference/cli-command-vocabulary#why-it-works-this-way) |
| 0072 | Add and remove Nodes without changing the machine | [Node provisioning: Removal does not clean the machine](/docs/reference/node-provisioning#removal-does-not-clean-the-machine) |
| 0073 | Store deploy steps as named Instance records | [Production release layout: Deploy steps](/docs/reference/deployments#deploy-steps) |
| 0074 | Hibernate idle app-dev Instance Processes | [App-dev runtime hibernation](/docs/reference/app-dev-runtime-hibernation) |
| 0075 | Prune idle app-dev checkout dependencies | [App-dev runtime hibernation: Dependency prune](/docs/reference/app-dev-runtime-hibernation#dependency-prune) |
| 0076 | Deliver features through complete pull requests | [Contributor guide: Decisions ship with their feature](/docs/contributor-guide#decisions-ship-with-their-feature) |
| 0077 | Allow the database role beside router | [Database role: The remaining conflicts](/docs/reference/database-role#the-remaining-conflicts) |
| 0078 | Assign Vite ports to development Instances | [Assigned Vite ports](/docs/reference/assigned-vite-ports) |
| 0079 | Publish linux-x64 from hosted GitHub Actions and macos-arm64 from mini | [CLI binaries](/docs/reference/cli-binaries) |
| 0080 | Add node-owned custom proxy Routes for arbitrary hostnames | [Routes: Custom proxy Routes](/docs/reference/routes#custom-proxy-routes) |
| 0081 | Query registered mysql, pgsql, and sqlite connections through PDO | [Database connections: Inspect a registered connection](/docs/reference/database-connections#inspect-a-registered-connection) |
| 0082 | Wire Agentation watch mode through Instance Processes | [Agentation](/docs/reference/agentation) |
| 0083 | Default SQLite journal\_mode to WAL | [SQLite WAL default](/docs/solutions/sqlite-wal-default) |
| 0084 | Broadcast record changes through Reverb | [Realtime events](/docs/reference/events) |
| 0085 | Build orbit top as a thin TUI client (superseded) | [Web app: One live fleet view](/docs/reference/web-app#one-live-fleet-view) |
| 0086 | Offer the API as MCP tools | [MCP server: Why it works this way](/docs/reference/mcp#why-it-works-this-way) |
| 0087 | Run Reverb through a websocket role | [Realtime events with Reverb](/docs/solutions/realtime-reverb) |
| 0088 | CLI reads display metrics from Grafana | [Metrics role: Read Node metrics](/docs/reference/metrics#read-node-metrics) |
| 0089 | Index Instance dependencies | [Instance dependencies](/docs/reference/instance-dependencies) |
| 0090 | Relocate the gateway role independently of vpn | [node: A dedicated relocate for gateway](/docs/cli/node#a-dedicated-relocate-for-gateway) |
| 0091 | Rename a Node without changing WireGuard identity | [node: node:rename](/docs/cli/node#orbit-noderename) |
| 0092 | Publish private DNS on the VPN node after gateway relocate | [Relocate the gateway role](/docs/solutions/relocate-gateway-role) |
| 0093 | Show live UFW and desired rules that match converge | [firewall: Read the managed and live rules](/docs/cli/firewall#read-the-managed-and-live-rules) |
| 0094 | Project WireGuard hub config onto the VPN node | [Node provisioning: The hub stays on the vpn Node](/docs/reference/node-provisioning#the-hub-stays-on-the-vpn-node) |
| 0095 | Relocate relocatable singleton roles as one Orbit action | [node: node:role:relocate](/docs/cli/node#orbit-noderolerelocate) |
| 0096 | Run Plausible through an analytics role | [Analytics role](/docs/reference/analytics) |
| 0097 | Publish analytics tracking hosts for Instances | [Analytics role: Why it works this way](/docs/reference/analytics#why-it-works-this-way) |
| 0098 | Read GitHub repositories through a Gateway-owned GitHub App | [GitHub App: Why it works this way](/docs/reference/github-app#why-it-works-this-way) |
| 0099 | Collect role-specific service metrics | [Service metrics](/docs/reference/service-metrics) |
| 0100 | Install Caddy from the pinned Caddy apt source (superseded) | [Node provisioning: Caddy from its GitHub release, not its apt source](/docs/reference/node-provisioning#caddy-from-its-github-release-not-its-apt-source) |
| 0101 | Keep one Route publication field and terminate public Ingress with Let's Encrypt | [Routes: Publish a public Route](/docs/reference/routes#publish-a-public-route) |
| 0102 | Read Instance analytics through a fleet driver | [Instance analytics stats](/docs/reference/instance-analytics-stats) |
| 0103 | Absorb Commander tasks as a Gateway extension | [Tasks: An optional, generic extension](/docs/reference/tasks#an-optional-generic-extension) |
| 0104 | Own CLIProxyAPI quota through the proxycli extension | [proxycli: Why it works this way](/docs/reference/proxycli#why-it-works-this-way) |
| 0105 | Name applications as Project and Instance | [Projects: Project and Instance](/docs/reference/projects#project-and-instance) |
| 0106 | Derive instance capabilities from Project type | [Projects: Project types](/docs/reference/projects#project-types) |
| 0107 | Key isolation and releases to Node role | [Instance environment variables: Laravel mode](/docs/reference/environment-variables#laravel-mode), [Production release layout](/docs/reference/deployments), and [Instance cloning](/docs/reference/instance-cloning) |
| 0108 | Persist managed environment on systemd Processes | [Processes and schedules: Environment of a systemd Process](/docs/reference/processes-and-schedules#environment-of-a-systemd-process) |
| 0109 | Publish the proxycli collector on a subdomain | [proxycli: A reserved name, not a Route](/docs/reference/proxycli#a-reserved-name-not-a-route) |
| 0110 | Route task sessions with Laravel AI Jev | [Tasks: Session routing (Jev routing removed)](/docs/reference/tasks#session-routing) |
| 0111 | Retain completed transfer history through Instance removal | [Instance removal: Keep unfinished transfer history](/docs/reference/instance-removal#keep-unfinished-transfer-history) |
| 0112 | Isolate agent threads behind drivers | [Tasks: Agent threads](/docs/reference/tasks#agent-threads) |
| 0113 | Gate task completion on validation and review | [Tasks: Rubric and reminders](/docs/reference/tasks#rubric-and-reminders) |
| 0114 | Expand the three-node Incus Cluster (superseded) | [Incus topologies: Declared roles only](/docs/reference/incus-topologies#declared-roles-only) |
| 0114 | Judge task completion as separate checks | [Tasks: Rubric and reminders](/docs/reference/tasks#rubric-and-reminders) |
| 0115 | Run Project setup commands on development Instances | [Instance setup and teardown](/docs/reference/instance-setup) |
| 0116 | Run task implementers on Pi | [Tasks: Drivers](/docs/reference/tasks#drivers) |
| 0117 | Judge the blocked question on the role's own evidence | [Tasks: Rubric and reminders (Jev question removed)](/docs/reference/tasks#rubric-and-reminders) |
| 0118 | Skip selected Nodes for a Project | [Development node exclusions](/docs/reference/development-node-exclusions) |
| 0119 | Share caches after bootstrap | [Feature delivery: Only main CI publishes](/docs/reference/implementation-loop#only-main-ci-publishes) |
| 0120 | Extract the agent annotation package | [Agent annotation](/docs/reference/agent-annotation) |
| 0121 | End agent turns with a turn receipt | [Tasks: Turn receipt](/docs/reference/tasks#turn-receipt) |
| 0122 | Hold tasks in Backlog until they are ready | [Tasks: Prepare a task in Backlog](/docs/reference/tasks#prepare-a-task-in-backlog) |
| 0123 | Serve the web app from the Gateway origin | [Web app: Why it works this way](/docs/reference/web-app#why-it-works-this-way) |
| 0124 | Plan Backlog tasks with a T3 planner | [Tasks: Prepare a task in Backlog (planner removed)](/docs/reference/tasks#prepare-a-task-in-backlog) |
| 0125 | Run the Project check when the implementer hands off | [Tasks: Project check](/docs/reference/tasks#project-check) |
| 0126 | Limit browser API calls to Orbit origins | [Browser access to the Gateway](/docs/reference/browser-access) |
| 0127 | Share one SSH connection per Node | [Node provisioning: SSH connections](/docs/reference/node-provisioning#ssh-connections) |
| 0128 | Run a visibility-only agent on managed Nodes | [Node agent: The agent only observes](/docs/reference/node-agent#the-agent-only-observes) |
| 0129 | Publish Node presence and Process state on per-Node presence channels | [Realtime events: Node agent channels](/docs/reference/events#node-agent-channels) |
| 0130 | Publish agent binaries as GitHub releases | [Node agent: Releases](/docs/reference/node-agent#releases) |
| 0131 | Seed task workspace clones from the registered main cache store | [Feature delivery: Seed a checkout](/docs/reference/implementation-loop#seed-a-checkout) |
| 0132 | Pause a task only for its acting thread or a real question | [Tasks: Session routing](/docs/reference/tasks#session-routing) |
| 0133 | Verify typed subtask deliverables at handoff | [Tasks: Deliverables](/docs/reference/tasks#deliverables) |
| 0134 | Resume Pi agent streams from a cursor | [Tasks: Agent viewer](/docs/reference/tasks#agent-viewer) |
| 0135 | Run Incus topologies for task workspace clones through a bridge worktree | Deleted with shared mode: [Incus topologies](/docs/reference/incus-topologies) |
| 0136 | Run long-lived topology processes as transient units | [Incus topologies: Long-lived processes as systemd units](/docs/reference/incus-topologies#long-lived-processes-as-systemd-units) |
| 0137 | Refuse carried Caddy global options | [Caddy configuration: Why it works this way](/docs/reference/caddy-configuration#orbit-owns-the-global-options) |
| 0138 | Opt public Ingress sites into Caddy certificate automation | [Caddy configuration: Public Ingress certificates](/docs/reference/caddy-configuration#public-ingress-certificates) |
| 0139 | Collect Caddy HTTP metrics on every Node | [Caddy configuration: Published layout](/docs/reference/caddy-configuration#published-layout) |
| 0140 | Watch settling pull requests for conflicts and failed checks | [Tasks: Fix a settling pull request](/docs/reference/tasks#fix-a-settling-pull-request) |
| 0141 | Build each Node's Caddyfile on the Gateway | [Caddy configuration: Node Caddy build](/docs/reference/caddy-configuration#node-caddy-build) |
| 0142 | Apply Plausible's ClickHouse configuration from the analytics role | [Analytics role: ClickHouse configuration](/docs/reference/analytics#clickhouse-configuration) |
| 0143 | Record topology evidence and sync without verification | [Incus topologies: Evidence log](/docs/reference/incus-topologies#evidence-log) |
| 0144 | Migrate waiting connections when Caddy reloads | [Node provisioning: Caddy reloads](/docs/reference/node-provisioning#caddy-reloads) |
| 0145 | Publish the proxycli collector on collector.cli-proxy-api.orbit | [proxycli: A reserved name, not a Route](/docs/reference/proxycli#a-reserved-name-not-a-route) |
| 0146 | Retire the Herdr integration | [extension (Herdr is removed)](/docs/cli/extension) |
| 0147 | Retire orbit top | [Web app: One live fleet view](/docs/reference/web-app#one-live-fleet-view) |
| 0148 | Keep a Gateway view of Node agent state | [Node agent: Gateway view](/docs/reference/node-agent#gateway-view) |
| 0149 | Install the private DNS listener from the Gateway | [Private DNS: Release and sockets](/docs/reference/private-dns#release-and-sockets) |
| 0150 | Keep extension commands local and confirm the proxycli fleet stop | [extension: Why it works this way](/docs/cli/extension#why-it-works-this-way) |
| 0151 | Push task and Process usage changes over realtime | [Realtime events: Tasks](/docs/reference/events#tasks) |
| 0152 | Sample successful read activity | [activity: What the Gateway records](/docs/cli/activity#what-the-gateway-records) |
| 0153 | Tail Instance and Process logs live through the Node agent | [Live logs](/docs/reference/live-logs) |
| 0154 | Recover the Gateway agent view without a membership change | [Node agent: Rejoin to ask for a snapshot](/docs/reference/node-agent#rejoin-to-ask-for-a-snapshot) |
| 0155 | Authenticate the Node agent with a per-Node secret | [Node agent: Agent secret](/docs/reference/node-agent#agent-secret) |
| 0156 | Route the private domain on the Gateway machine to VPN DNS | [Private DNS: The Gateway machine](/docs/reference/private-dns#the-gateway-machine) |
| 0157 | Keep private Caddy sites off the public listener | [Caddy configuration: Listener addresses](/docs/reference/caddy-configuration#listener-addresses) |
| 0158 | End interrupted Activity | [activity: Interrupted requests](/docs/cli/activity#interrupted-requests) |
| 0159 | Push Activity changes to the web app | [Realtime events: Activity](/docs/reference/events#activity) |
| 0160 | Push each approved subtask and remove the finished workspace clone | [Tasks: Pull request and settle metrics](/docs/reference/tasks#pull-request-and-settle-metrics) |
| 0161 | Set a stale Caddyfile aside when Caddy is absent | [Caddy configuration: When Caddy is absent](/docs/reference/caddy-configuration#when-caddy-is-absent) |
| 0162 | Verify web UI changes with bin/web-verify | [Web verification: Why it works this way](/docs/reference/web-verification#why-it-works-this-way) |
| 0163 | Prove a failing test on the start commit | [Tasks: Prove a command fails on the start commit](/docs/reference/tasks#prove-a-command-fails-on-the-start-commit) |
| 0164 | Heal a settling pull request with a fixup subtask | [Tasks: Fix a settling pull request](/docs/reference/tasks#fix-a-settling-pull-request) |
| 0165 | Record per-thread token metrics | [Tasks: Thread token metrics](/docs/reference/tasks#thread-token-metrics) |
| 0166 | Raise PHPStan one level at a time | [Feature delivery: Findings are fixed, not silenced](/docs/reference/implementation-loop#findings-are-fixed-not-silenced) |
| 0167 | Resume a Pi turn interrupted by a server restart | [Tasks: Recover a Pi server restart](/docs/reference/tasks#recover-a-pi-server-restart) |
| 0168 | Offload large Pi tool output | [Pi server: Large tool output](/docs/reference/pi-server#large-tool-output) |
| 0169 | Start each subtask review in a fresh thread | [Tasks: Review a subtask](/docs/reference/tasks#review-a-subtask) |
| 0170 | Edit Todo subtasks after a group starts | [Tasks: Change subtasks](/docs/reference/tasks#change-subtasks) |
| 0171 | Reset fixup caps after operator work | [Tasks: Fix a settling pull request](/docs/reference/tasks#fix-a-settling-pull-request) |
| 0172 | Count every T3 model call in thread metrics | [Tasks: Thread token metrics](/docs/reference/tasks#thread-token-metrics) |
| 0173 | Record and label every Jev decision | [Tasks: Jev decision records](/docs/reference/tasks#jev-decision-records) |
| 0174 | Match the task gate to CI and repeated findings | [Feature delivery: The candidate gate](/docs/reference/implementation-loop#the-candidate-gate) |
| 0175 | Keep the docs-impact check in Orbit's repository | [Contributor guide: Docs impact stays in the repository](/docs/contributor-guide#docs-impact-stays-in-the-repository) |
| 0176 | File recurring production problems as repro-first bug groups | [Tasks: Outer loop](/docs/reference/tasks#outer-loop) |
| 0177 | Remove the app compatibility surface | [Projects: One public name without compatibility](/docs/reference/projects#one-public-name-without-compatibility) |
| 0178 | Run project-agnostic Tasks without a planner | [Tasks: Project-owned task policy](/docs/reference/tasks#project-owned-task-policy) |
| 0179 | Gate every extension surface with one Gateway switch | [extension: Why it works this way](/docs/cli/extension#why-it-works-this-way) |
| 0180 | Absorb built decisions into the documentation | [Architecture decisions: Why it works this way](/docs/decisions/overview#why-it-works-this-way) |
| 0181 | Name the domain Project and Instance everywhere | [Projects: Project and Instance](/docs/reference/projects#project-and-instance) |
| 0183 | Manage macOS tools without service roles | [Node provisioning: A Mac needs no service role](/docs/reference/node-provisioning#a-mac-needs-no-service-role) |
| 0184 | Adopt selected tools from existing managers | [Tools: Selected adoption](/docs/reference/tools#selected-adoption) |
| 0185 | Report informational tool discoveries in Doctor | [doctor: Informational findings stay healthy](/docs/cli/doctor#informational-findings-stay-healthy) |
| 0187 | Ask the reviewer before the operator and record every question | [Tasks: Questions go through the reviewer](/docs/reference/tasks#questions-go-through-the-reviewer) |
| 0188 | Read private GitHub repositories through the Gateway's GitHub CLI | [GitHub App: Read through the GitHub CLI](/docs/reference/github-app#read-through-the-github-cli) |
| 0189 | Register Instances only for existing Projects | [Projects: Registration needs a Project](/docs/reference/projects#registration-needs-a-project) |
| 0192 | Run task agents on Pi only | [Tasks: Task agents run on Pi](/docs/reference/tasks#task-agents-run-on-pi) |
| 0192 | Stop a group whose pull request ended | [Tasks: A watched pull request is not the reviewed pull request](/docs/reference/tasks#a-watched-pull-request-is-not-the-reviewed-pull-request) |
| 0193 | Run task agents as a dedicated user | [Pi server: One user for every task agent](/docs/reference/pi-server#one-user-for-every-task-agent); [GitHub App: The checkout cannot inherit the token](/docs/reference/github-app#the-checkout-cannot-inherit-the-token) |
| 0193 | Record development branch renames | [Applications: Development branch reconciliation](/docs/domains/applications#development-branch-reconciliation) |
| 0194 | Respond to GitHub review feedback | [Tasks: Trusted reviews are input, not merge authority](/docs/reference/tasks#trusted-reviews-are-input-not-merge-authority) |
| 0195 | Request topologies for review with an operator container | [Incus topologies: Nested in the task VM](/docs/reference/incus-topologies#nested-in-the-task-vm); [Incus topologies: An isolated operator for web work](/docs/reference/incus-topologies#an-isolated-operator-for-web-work) |
| 0197 | Native Project Documents with private UpCloud S3 storage | [Project Documents: Why it works this way](/docs/reference/project-documents#why-it-works-this-way) |
| 0199 | Post direction requests to OpsBot immediately | [Tasks: Direction wakes OpsBot immediately](/docs/reference/tasks#direction-wakes-opsbot-immediately) |
| 0201 | Release the Gateway automatically from green main | [Update and recover a Gateway: Automatic releases](/docs/reference/gateway-recovery#automatic-releases); [Update and recover a Gateway: Why it works this way](/docs/reference/gateway-recovery#why-it-works-this-way) |
| 0202 | The fleet follows the Gateway through orbit self-update | [Update and recover a Gateway: Fleet rollout](/docs/reference/gateway-recovery#fleet-rollout); [Orbit self-update](/docs/reference/self-update); [Node agent: The agent only observes](/docs/reference/node-agent#the-agent-only-observes) |
| 0203 | Review and merge pull requests inside Orbit | [Tasks: Review and merge](/docs/reference/tasks#review-and-merge); [Tasks: Orbit reviews before it pushes](/docs/reference/tasks#orbit-reviews-before-it-pushes); [GitHub App: How Orbit reviews and merges a pull request](/docs/reference/github-app#how-orbit-reviews-and-merges-a-pull-request) |
| 0208 | Deploy the Gateway with Laravel migrations and explicit database recovery | [Update and recover a Gateway: Laravel owns migrations](/docs/reference/gateway-recovery#laravel-owns-migrations) |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.