# Orbit > Orbit turns the machines you already own into an always-on development network. Your agent provisions, routes, and repairs it. - [Orbit documentation](https://orbit.nckrtl.com/docs/index.md): Orbit turns the machines you own into an always-on network for developing and hosting your applications. Your agent operates it. You steer. - [Quickstart](https://orbit.nckrtl.com/docs/quickstart.md): Hand this page to your coding agent and follow along. It installs a Gateway, adds a development Node, and opens your first Project at its own private HTTPS address. - [Mission](https://orbit.nckrtl.com/docs/mission.md): What Orbit is for, where it stops, and the principles every decision must fit. - [Architecture](https://orbit.nckrtl.com/docs/architecture.md): Orbit's components, the boundaries between them, and the four paths that connect them. - [Concepts](https://orbit.nckrtl.com/docs/concepts.md): The core terms Orbit uses. Each domain page defines its own detailed terms. - [Tech stack](https://orbit.nckrtl.com/docs/tech-stack.md): The languages, frameworks, and platform each part of Orbit uses. - [Applications](https://orbit.nckrtl.com/docs/domains/applications.md): How a Project becomes an Instance on a Node: create or adopt a development checkout, provision its endpoint, clone to production, move, and remove. - [Projects](https://orbit.nckrtl.com/docs/reference/projects.md): How a Project records one repository, its type, its source access, and the source defaults that Instances inherit, and how create, update, and removal work. - [Project Documents](https://orbit.nckrtl.com/docs/reference/project-documents.md): Native Project folders, versioned files, editing, private S3 storage, and the shared API, CLI, SDK, MCP, and web contract. - [Routes](https://orbit.nckrtl.com/docs/reference/routes.md): What a Route records, how Orbit projects its private traffic path through a Node or Router, and which later changes it coordinates or refuses. - [Instance environment variables](https://orbit.nckrtl.com/docs/reference/environment-variables.md): How the Gateway imports, stores, updates, and synchronizes an Instance .env file without exposing its values. - [Gateway environment](https://orbit.nckrtl.com/docs/reference/gateway-environment.md): Where the Gateway reads its own .env settings, how to apply a change, and what each key in the example file does. - [Database connections](https://orbit.nckrtl.com/docs/reference/database-connections.md): The Gateway-owned registry of mysql, pgsql, sqlite, and redis connections, the databases that Instances own, their test databases, and how an operator attaches a connection to an Instance. - [Database servers](https://orbit.nckrtl.com/docs/reference/database-servers.md): How Orbit runs a MySQL server as a Docker Node Process, keeps its root password only in the Gateway, and creates databases on it. - [Vaultwarden](https://orbit.nckrtl.com/docs/reference/vaultwarden.md): How the Gateway publishes database credentials into a Vaultwarden collection as Database items, keeps them current, and deletes them when their source is gone. - [Processes and schedules](https://orbit.nckrtl.com/docs/reference/processes-and-schedules.md): How Orbit runs Processes for an Instance or a Node, and how a Project declares Process and Schedule definitions that production Instances copy. - [Schedules](https://orbit.nckrtl.com/docs/reference/schedules.md): How the Gateway stores a Schedule, projects it to a native systemd timer, reports its latest run, and removes its owned state. - [App-dev runtime hibernation](https://orbit.nckrtl.com/docs/reference/app-dev-runtime-hibernation.md): How Orbit stops the Processes of idle development Instances, prunes their dependencies after a long idle period, and wakes them on the next HTTP request. - [Assigned Vite ports](https://orbit.nckrtl.com/docs/reference/assigned-vite-ports.md): How Orbit gives each development Instance its own Vite port, and how the vp-dev Process preset connects that port to systemd, Caddy, and wake. - [Assigned SSR ports](https://orbit.nckrtl.com/docs/reference/assigned-ssr-ports.md): How Orbit gives each development Instance its own Inertia SSR port, and the environment contract that applications follow so two task workspaces on one Node never share an SSR server. - [Agentation](https://orbit.nckrtl.com/docs/reference/agentation.md): How Orbit runs the Agentation HTTP server and the Antigravity watcher as Processes of a development Instance, publishes the server on the Route origin, and projects AGENTATION_URL. - [Agent annotation](https://orbit.nckrtl.com/docs/reference/agent-annotation.md): How Orbit uses the @nckrtl/annotator browser overlay: the Orbit delivery mode that sends annotations to a T3 thread as Tasks, and the annotator Instance Process. - [PHP runtimes](https://orbit.nckrtl.com/docs/reference/php-runtime.md): How Orbit selects a PHP version for an Instance, runs shared development and dedicated production PHP-FPM services, and refreshes production OPcache. - [Instance cloning](https://orbit.nckrtl.com/docs/reference/instance-cloning.md): How the Gateway creates a prepared production Instance from a development or production candidate, with an optional SQLite seed. - [Instance releases](https://orbit.nckrtl.com/docs/reference/deployments.md): How production Instances build releases and select current code, and how development defaults deploy in their checkout. - [Instance setup and teardown](https://orbit.nckrtl.com/docs/reference/instance-setup.md): How a Project stores named setup and teardown commands, and when Orbit runs them for a development Instance. - [Development node exclusions](https://orbit.nckrtl.com/docs/reference/development-node-exclusions.md): How a Project skips selected app-dev Nodes for development placement, from the Project or from the Node, including MCP. - [Instance logs](https://orbit.nckrtl.com/docs/reference/instance-logs.md): How the Gateway reads the application log of an Instance, which file it reads, what it redacts, and how a viewer follows it live. - [Live logs](https://orbit.nckrtl.com/docs/reference/live-logs.md): How a viewer tails an Instance log or a Process log live: opening, renewing, and closing a log stream, the events it receives, the limits, redaction, and the fallback to one-shot reads. - [Instance queue](https://orbit.nckrtl.com/docs/reference/instance-queue.md): How the Gateway reads the Laravel Horizon queue of an Instance, what it returns, and what it never returns. - [Instance analytics stats](https://orbit.nckrtl.com/docs/reference/instance-analytics-stats.md): How the Gateway reads live visitors, period visitor counts, and top pages for an Instance, and when the Orbit web page shows that panel. - [Instance dependencies](https://orbit.nckrtl.com/docs/reference/instance-dependencies.md): Record the resolved Composer and JavaScript dependencies of each Instance, and update a development Instance within its declared constraints. - [Dependency contracts](https://orbit.nckrtl.com/docs/reference/instance-dependency-contracts.md): The graph values, lockfile reader rules, collection limits, stored tables, and response shapes behind Instance dependency inventory. - [Instance removal](https://orbit.nckrtl.com/docs/reference/instance-removal.md): How Orbit removes an Instance, what --force changes for development source, how owned Processes and Schedules go with it, and how an interrupted removal resumes. - [Instance transfer](https://orbit.nckrtl.com/docs/reference/instance-transfer.md): How the Gateway moves one development Instance to another app-dev Node, keeps its ID, and recovers from a failed or interrupted move. - [Gateway trust](https://orbit.nckrtl.com/docs/reference/gateway-trust.md): How the CLI stores Gateway profiles, pins the Gateway root certificate, installs it in the operating-system trust store, and recovers when a profile changes during a trust command. - [Web app](https://orbit.nckrtl.com/docs/reference/web-app.md): How the Gateway serves the Orbit web app at https://gateway.orbit, how the app stays live, and how open pages move to a new release. Also how each Gateway release installs its CI build, how bin/web-deploy releases it by hand, and how to roll a release back. - [Desktop app](https://orbit.nckrtl.com/docs/reference/desktop-app.md): What the Orbit desktop app is today, how to run it against a local web app, how its build loads the web app from the Gateway, and what it does not do yet. - [Browser access to the Gateway](https://orbit.nckrtl.com/docs/reference/browser-access.md): Which web pages may call the Gateway API and MCP endpoints from a browser, and how the Gateway refuses the rest. - [Update and recover a Gateway](https://orbit.nckrtl.com/docs/reference/gateway-recovery.md): Preserve source, state, and keys through a Gateway update, recover from a failed update, find the request logs, receive release alerts, and follow the fleet rollout. - [Node provisioning](https://orbit.nckrtl.com/docs/reference/node-provisioning.md): How node:add bootstraps or converges a Node, how roles share and lock a Node, how the Orbit CLI and footprint reach it, and how node:remove hands it back. - [Caddy configuration](https://orbit.nckrtl.com/docs/reference/caddy-configuration.md): How the Gateway builds each Node's whole Caddyfile from its database and pushes it in one step, and what happens when a build fails. - [Node settings](https://orbit.nckrtl.com/docs/reference/node-settings.md): Node settings: the apps.path root. Input, the effective apps root, validation, preparation, and failure codes. - [Node retarget](https://orbit.nckrtl.com/docs/reference/node-retarget.md): How the Gateway moves a Node to a new public SSH target over public SSH or WireGuard without changing its identity, and how one lifecycle owner serializes Node changes. - [WireGuard endpoints](https://orbit.nckrtl.com/docs/reference/wireguard-endpoints.md): Accepted endpoint forms, generated defaults, and recovery for an invalid stored WireGuard endpoint. - [Private DNS](https://orbit.nckrtl.com/docs/reference/private-dns.md): How a managed Node selects its resolver, how the Gateway answers Cluster Router addresses, and how to inspect and repair one peer. - [Tools](https://orbit.nckrtl.com/docs/reference/tools.md): Where Tools run, the supported Tool Managers, how Orbit discovers, adopts, installs, updates, and removes one package, and why the contract stays closed. - [GitHub App](https://orbit.nckrtl.com/docs/reference/github-app.md): How a Gateway registers its own GitHub App and installs it on a GitHub account. How Orbit reads private repositories through the App or the Gateway's GitHub CLI, publishes task pull requests, reviews and merges pull requests, and finds the newest green commit of a branch. - [Database role](https://orbit.nckrtl.com/docs/reference/database-role.md): What the database role converges on a Node, which roles it shares a Node with, and how add, converge, and remove behave. - [Node agent](https://orbit.nckrtl.com/docs/reference/node-agent.md): What orbit-agent observes on a managed Node, how it connects and authenticates, how the Gateway installs it and keeps a view of its reports, and how Doctor checks it. - [Metrics role](https://orbit.nckrtl.com/docs/reference/metrics.md): What the metrics role runs, how to enable, inspect, and disable it, and how Grafana access is authorized. - [Service metrics](https://orbit.nckrtl.com/docs/reference/service-metrics.md): Caddy proxy traffic and dedicated production PHP-FPM capacity monitoring. - [Analytics role](https://orbit.nckrtl.com/docs/reference/analytics.md): How the analytics role runs Plausible Community Edition, where it keeps its data, and how an Instance publishes a tracking host. - [proxycli](https://orbit.nckrtl.com/docs/reference/proxycli.md): The optional Orbit extension that collects CLIProxyAPI quota and its model list into shared Valkey, and publishes provider pools at collector.cli-proxy-api.orbit. - [Gateway queue](https://orbit.nckrtl.com/docs/reference/gateway-queue.md): The Gateway's Redis queue, its two queues, Laravel Horizon, and how a release moves them. - [Tasks](https://orbit.nckrtl.com/docs/reference/tasks.md): How the optional Gateway Tasks extension runs tasks and stores each Project's task definitions. It covers the model, definition fields, validation, the lifecycle, typed deliverables, the task check, agent threads, review, the pull request, fixups, metrics, cleanup, and the outer loop that files recu… - [Compute drivers](https://orbit.nckrtl.com/docs/reference/compute-drivers.md): Task VMs for every Project and their UpCloud overflow. - [Pi server](https://orbit.nckrtl.com/docs/reference/pi-server.md): How the Pi server runs Pi agent sessions on a task VM for the Gateway's pi driver: configuration, the task VM install, agent tools, API, thread states, and restart behavior. - [Conn layer](https://orbit.nckrtl.com/docs/reference/conn.md): How the Gateway signs in Conn devices as Nodes, shares workspaces, appearance, and per-device settings through profiles, holds an admin session for each registered T3 server, and mints and revokes device pairings. - [CLI binaries](https://orbit.nckrtl.com/docs/reference/cli-binaries.md): Published Orbit CLI releases for every green main commit: versions, tags, assets, checksums, how to find and install one, the pull-request builds, and how to build locally. - [Orbit self-update](https://orbit.nckrtl.com/docs/reference/self-update.md): The desired fleet state the Gateway serves for its commit, how orbit self-update replaces the CLI and the Node agent from it, and how the CLI learns that a newer release exists. - [Realtime events](https://orbit.nckrtl.com/docs/reference/events.md): The channel, authorization, discovery, envelope, and full catalogue of the events the Gateway broadcasts through Reverb, and the per-Node channels that Node agents publish on. - [MCP server](https://orbit.nckrtl.com/docs/reference/mcp.md): The Gateway's Model Context Protocol server: every API operation as a tool, identified by WireGuard address, with a search variant for small contexts. - [Your first contribution](https://orbit.nckrtl.com/docs/first-contribution.md): The steps a person follows to make a first change to Orbit, from a fresh clone to a merged pull request. - [Contributing to Orbit](https://orbit.nckrtl.com/docs/contributor-guide.md): Prepare architecture and documentation, build a feature, and submit a complete pull request. - [Bun and Rust projects](https://orbit.nckrtl.com/docs/reference/bun-and-rust-projects.md): How to install, run, and check the web app, the Pi server, the Node agent, and the desktop app, the four Orbit projects that are not Composer projects. - [Feature delivery](https://orbit.nckrtl.com/docs/reference/implementation-loop.md): How a change reaches main: review evidence, merge, CI, local checks, worktrees, and the shared main caches. - [Delivery-line proofs](https://orbit.nckrtl.com/docs/reference/delivery-line.md): Five repository commands that prove reproduction, task-group shape, pull-request head review, post-merge live state, and a healthy Gateway release, without filing, merging, deploying, or rolling back. - [Incus topologies](https://orbit.nckrtl.com/docs/reference/incus-topologies.md): How the harness composes a disposable Incus topology from declared Nodes and per-role images, runs it nested in a task VM or on a bare host, and releases it. - [API reference generation](https://orbit.nckrtl.com/docs/reference/api-reference.md): Contract and inputs for bin/docs-openapi, including the Gateway route list outside the checkout. - [Gateway response fixtures](https://orbit.nckrtl.com/docs/reference/gateway-response-fixtures.md): Recorded Gateway responses are the contract that CLI tests replay, so a response change shows which commands it reaches before it ships. - [CLI command vocabulary](https://orbit.nckrtl.com/docs/reference/cli-command-vocabulary.md): The verbs, family actions, and noun-ending commands that name every CLI command and its Gateway route. - [CLI design standard](https://orbit.nckrtl.com/docs/reference/cli-ux.md): How Orbit CLI commands collect input, ask for consent, and present results, progress, and failures. - [Web verification](https://orbit.nckrtl.com/docs/reference/web-verification.md): How bin/web-verify runs the web app in demo mode so an agent can open a route, click a control, and save phone and desktop screenshots. - [Source alpha](https://orbit.nckrtl.com/docs/reference/alpha.md): A bounded trial, known limits, release criteria, and feedback. - [Prove the verify-only Doctor on an Incus topology](https://orbit.nckrtl.com/docs/solutions/doctor-incus-proof.md): A repeatable way to prove that Doctor reports drift without repairing it, on disposable machines. - [Reduce Incus VM costs on ZFS](https://orbit.nckrtl.com/docs/solutions/incus-zfs-efficiency.md): Measured ways to reduce prepared topology storage, dependency-copy writes, and VM memory without adding runtime controllers. - [Remote file writes on uutils coreutils](https://orbit.nckrtl.com/docs/solutions/remote-file-writes-on-uutils-coreutils.md): Why writing a remote file from standard input with install fails on uutils coreutils, and the write sequence that works. - [Migrate an unmanaged Executor hostname](https://orbit.nckrtl.com/docs/solutions/migrate-unmanaged-executor-hostname.md): Replace a hand-placed Caddy fragment for a Node Process, such as executor.test, with a Gateway-owned custom proxy Route. - [SQLite WAL default](https://orbit.nckrtl.com/docs/solutions/sqlite-wal-default.md): Why Orbit-owned SQLite connections use WAL, and how to confirm that a Laravel app opens new databases in that mode. - [Realtime events with Reverb](https://orbit.nckrtl.com/docs/solutions/realtime-reverb.md): Turn on realtime events with the websocket role, what its converge installs, how to move it, and how to verify it. - [Relocate the gateway role](https://orbit.nckrtl.com/docs/solutions/relocate-gateway-role.md): Move the Gateway to another Node while vpn and private DNS stay on the original Node. - [Using the CLI](https://orbit.nckrtl.com/docs/cli/overview.md): How the orbit command line talks to the Gateway, selects records, confirms destructive changes, and returns machine-readable output. - [gateway](https://orbit.nckrtl.com/docs/cli/gateway.md): Register Gateway profiles on the operator machine, select the active one, pin the Gateway root certificate, check Gateway status, and release the Gateway itself. - [node](https://orbit.nckrtl.com/docs/cli/node.md): Add machines to the fleet, rename Nodes, set unmanaged WireGuard keys, assign and move roles, grant access, set the apps root, read metrics, and remove Nodes. - [cluster](https://orbit.nckrtl.com/docs/cli/cluster.md): Group Nodes into a Cluster, give it a development TLD and one Router, and attach or detach member Nodes. - [firewall](https://orbit.nckrtl.com/docs/cli/firewall.md): Allow, deny, list, and remove named UFW rules on one Node through the Gateway. - [tool](https://orbit.nckrtl.com/docs/cli/tool.md): Discover installed packages, adopt one installed package, and install, update, show, and remove one package through apt, Vite+, Composer, or Homebrew. - [github](https://orbit.nckrtl.com/docs/cli/github.md): Register the Gateway's GitHub App, install it on a GitHub account, show it, or remove it from the Gateway. - [metrics](https://orbit.nckrtl.com/docs/cli/metrics.md): Enable the Prometheus and Grafana role on one Node, select which Nodes run an exporter, read the Grafana credential, and disable or purge the role. - [analytics](https://orbit.nckrtl.com/docs/cli/analytics.md): Pin the Plausible Community Edition version that the analytics role runs, and store the Stats API key the Gateway uses to read visits. - [dns](https://orbit.nckrtl.com/docs/cli/dns.md): Point a development TLD or one private Route name at an IP address from a macOS operator machine, or remove that override. - [project](https://orbit.nckrtl.com/docs/cli/project.md): Create, inspect, update, and remove Projects. A Project owns one repository, a type, and the source defaults that Instances inherit. - [instance](https://orbit.nckrtl.com/docs/cli/instance.md): Create, register, reconcile a renamed branch or domain, set up, clone, deploy, roll back, and remove Instances. - [route](https://orbit.nckrtl.com/docs/cli/route.md): Create Instance-targeted app Routes and Node-owned custom proxy Routes, change Route targets, domains, or publication intent, and remove Routes. - [env](https://orbit.nckrtl.com/docs/cli/env.md): Import, update, and synchronize the Gateway-owned environment configuration of one Instance. - [database](https://orbit.nckrtl.com/docs/cli/database.md): Run MySQL servers, create databases on them, and register, inspect, update, and destroy the mysql, pgsql, sqlite, and redis connections that Instances can attach. - [vault](https://orbit.nckrtl.com/docs/cli/vault.md): Set up, check, run, and tear down the copy of database credentials into a Vaultwarden collection. - [process](https://orbit.nckrtl.com/docs/cli/process.md): Install, update, start, stop, inspect, and remove systemd services and Docker containers owned by an Instance or a Node, and record Project-owned process definitions. - [schedule](https://orbit.nckrtl.com/docs/cli/schedule.md): Create, run, inspect, enable, and remove recurring commands that native systemd timers execute on a Node or an Instance, and record Project-owned Schedule definitions. - [doctor](https://orbit.nckrtl.com/docs/cli/doctor.md): Compare what the Gateway expects with what is on each Node and report every difference without repairing anything. - [profile](https://orbit.nckrtl.com/docs/cli/profile.md): Profile one HTTP request from the operator machine and show its timings. - [self-update](https://orbit.nckrtl.com/docs/cli/self-update.md): Update this machine to the Gateway's release: the orbit CLI, and orbit-agent on a managed Node. - [activity](https://orbit.nckrtl.com/docs/cli/activity.md): Read the Gateway's log of requests: who ran each command, what it targeted, and how it ended. - [realtime](https://orbit.nckrtl.com/docs/cli/realtime.md): Show where the Gateway's realtime server is, and stream realtime Gateway events as they arrive. - [extension](https://orbit.nckrtl.com/docs/cli/extension.md): Enable or disable optional Gateway extensions for every Orbit client. - [fleet](https://orbit.nckrtl.com/docs/cli/fleet.md): Show the fleet rollout that follows each Gateway release, and resume it after a halt. - [tasks](https://orbit.nckrtl.com/docs/cli/tasks.md): Create, prepare, inspect, cancel, and complete tasks, and read or replace a Project's task definitions, through the Gateway tasks extension. - [proxycli](https://orbit.nckrtl.com/docs/cli/proxycli.md): Set up the fleet CLIProxyAPI quota collector, read provider pools and the model list, and toggle accounts. - [Using the API](https://orbit.nckrtl.com/docs/api/overview.md): How a client reaches the Gateway API over WireGuard, how the Gateway identifies the caller, and how every request and response is shaped. - [PHP SDK](https://orbit.nckrtl.com/docs/api/php-sdk.md): Call the Gateway API from PHP with typed requests, typed responses, bounded errors, and a closeable deployment stream. - [Fetch the root CA certificate](https://orbit.nckrtl.com/docs/api-reference/gateway/fetch-the-root-ca-certificate.md): Returns the PEM-encoded Orbit root certificate and its SHA-256 fingerprint so a client can pin it before it trusts the Gateway. This endpoint needs no WireGuard identity. - [Show the desired fleet state](https://orbit.nckrtl.com/docs/api-reference/gateway/show-the-desired-fleet-state.md): Returns what every machine in the fleet should run for the Gateway's commit (ADR 0202): the full commit SHA, the CLI release CI published for that commit with the SHA-256 of each platform binary from its `SHA256SUMS`, and the pinned `orbit-agent` with the SHA-256 of each Linux binary. Any active Wir… - [gateway:release:auto:status](https://orbit.nckrtl.com/docs/api-reference/gateway/gateway:release:auto:status.md): Shows whether automatic Gateway releases are enabled or paused, the current release, the last runner tick, and how long releases have made no progress. See /reference/gateway-recovery#automatic-releases. - [gateway:release:auto:disable](https://orbit.nckrtl.com/docs/api-reference/gateway/gateway:release:auto:disable.md): Turns automatic Gateway releases off. A release that already runs finishes. - [gateway:release:auto:enable](https://orbit.nckrtl.com/docs/api-reference/gateway/gateway:release:auto:enable.md): Turns automatic Gateway releases on. A pause still holds them until `gateway:release:auto:resume`. - [gateway:release:auto:resume](https://orbit.nckrtl.com/docs/api-reference/gateway/gateway:release:auto:resume.md): Clears a pause of automatic Gateway releases after the operator decided how to recover. Refuses with `gateway.release_not_paused` when nothing is paused. - [gateway:release:smoke](https://orbit.nckrtl.com/docs/api-reference/gateway/gateway:release:smoke.md): Runs `bin/gateway-smoke` of the current release against the live Gateway, for the current commit or the `commit` you name, and answers when it ends. `since` is the runtime handoff time, ISO 8601 with a zone. Smoke restarts nothing and writes no release record, so it runs inside the request: its limi… - [gateway:release:list](https://orbit.nckrtl.com/docs/api-reference/gateway/gateway:release:list.md): Lists the 50 newest Gateway release records, newest first, including queued and running ones. - [gateway:release:deploy](https://orbit.nckrtl.com/docs/api-reference/gateway/gateway:release:deploy.md): Queues a manual release of one commit and starts `orbit-gateway-release-run@.service`, which prepares, migrates, switches, verifies, and smoke-tests it. Answers 202 with the queued release record; the release never runs in the API request. Follow it with `gateway:release:show ` until `fi… - [gateway:release:show](https://orbit.nckrtl.com/docs/api-reference/gateway/gateway:release:show.md): Shows one Gateway release record by its numeric id (1 to 6 digits), or the newest record of a commit named by a hex SHA of 7 to 40 characters. - [gateway:release:rollback](https://orbit.nckrtl.com/docs/api-reference/gateway/gateway:release:rollback.md): Queues a rollback to a retained release, named by its 12-digit id, and starts its release unit. Switches code only; restoring a database snapshot is an explicit operator step. Answers 202 with the queued release record. See /reference/gateway-recovery#roll-back. - [Show Gateway status](https://orbit.nckrtl.com/docs/api-reference/gateway/show-gateway-status.md): Returns the Gateway name, version, and status, and the release the Gateway runs from. This endpoint needs no WireGuard identity. For an active WireGuard peer it also returns `auto_release`, whether automatic releases are enabled or paused, and `desired_fleet_state`, the object `gateway:desired-fleet… - [List Nodes](https://orbit.nckrtl.com/docs/api-reference/nodes/list-nodes.md): List nodes registered with the active gateway. - [Add a Node](https://orbit.nckrtl.com/docs/api-reference/nodes/add-a-node.md): Add a node to the fleet: provision a new machine or converge an existing one. - [Remove a Node](https://orbit.nckrtl.com/docs/api-reference/nodes/remove-a-node.md): Remove a node registered with the active gateway. - [Show a Node](https://orbit.nckrtl.com/docs/api-reference/nodes/show-a-node.md): Show a node registered with the active gateway. - [node:converge](https://orbit.nckrtl.com/docs/api-reference/nodes/node:converge.md): Re-apply the Gateway-rendered Orbit footprint of a Node. It never changes an Instance or a role. - [node:excluded-project:list](https://orbit.nckrtl.com/docs/api-reference/nodes/node:excluded-project:list.md): List the Projects that cannot use an app-dev Node for development. - [node:excluded-project:remove](https://orbit.nckrtl.com/docs/api-reference/nodes/node:excluded-project:remove.md): Remove a Project from the development exclusions of an app-dev Node. - [node:excluded-project:add](https://orbit.nckrtl.com/docs/api-reference/nodes/node:excluded-project:add.md): Exclude a Project from development placement on an app-dev Node. - [node:metrics](https://orbit.nckrtl.com/docs/api-reference/nodes/node:metrics.md): Show one synchronous metrics snapshot for a node: cores, memory, swap, load, uptime, pressure, and disks. - [node:rename](https://orbit.nckrtl.com/docs/api-reference/nodes/node:rename.md): Change the unique registry name of a node. - [List the roles of a Node](https://orbit.nckrtl.com/docs/api-reference/nodes/list-the-roles-of-a-node.md): List role assignments for one node. - [Add a role to a Node](https://orbit.nckrtl.com/docs/api-reference/nodes/add-a-role-to-a-node.md): Add one role assignment to a node. - [Remove a role from a Node](https://orbit.nckrtl.com/docs/api-reference/nodes/remove-a-role-from-a-node.md): Remove one role assignment from a node. - [node:role:relocate](https://orbit.nckrtl.com/docs/api-reference/nodes/node:role:relocate.md): Move a relocatable singleton role to another node. - [Update Node settings](https://orbit.nckrtl.com/docs/api-reference/nodes/update-node-settings.md): Update typed storage settings on a node. - [node:wireguard-key](https://orbit.nckrtl.com/docs/api-reference/nodes/node:wireguard-key.md): Set an unmanaged Node's WireGuard public key and reconverge the hub. - [Revoke Node access](https://orbit.nckrtl.com/docs/api-reference/nodes/revoke-node-access.md): Remove one node access edge from the active gateway. - [Grant Node access](https://orbit.nckrtl.com/docs/api-reference/nodes/grant-node-access.md): Allow one node to run commands on another node. - [List Clusters](https://orbit.nckrtl.com/docs/api-reference/clusters/list-clusters.md): List Clusters. - [Create a Cluster](https://orbit.nckrtl.com/docs/api-reference/clusters/create-a-cluster.md): Create a Cluster. - [Remove a Cluster](https://orbit.nckrtl.com/docs/api-reference/clusters/remove-a-cluster.md): Remove an empty Cluster. - [Show a Cluster](https://orbit.nckrtl.com/docs/api-reference/clusters/show-a-cluster.md): Show a Cluster. - [Update a Cluster](https://orbit.nckrtl.com/docs/api-reference/clusters/update-a-cluster.md): Update a Cluster. - [Detach a Node from a Cluster](https://orbit.nckrtl.com/docs/api-reference/clusters/detach-a-node-from-a-cluster.md): Detach a Node from a Cluster. - [Attach a Node to a Cluster](https://orbit.nckrtl.com/docs/api-reference/clusters/attach-a-node-to-a-cluster.md): Attach a Node to a Cluster. - [Clear the Cluster Router](https://orbit.nckrtl.com/docs/api-reference/clusters/clear-the-cluster-router.md): Clear the Router from an inactive Cluster. - [Set the Cluster Router](https://orbit.nckrtl.com/docs/api-reference/clusters/set-the-cluster-router.md): Set or replace a Cluster Router. - [List firewall rules on every Node](https://orbit.nckrtl.com/docs/api-reference/firewall/list-firewall-rules-on-every-node.md): Returns the operator firewall rules of every Node the caller can reach, in one response, ordered by Node and name. The web app uses it for the fleet list instead of one request per Node. The per-Node list stays for the CLI. The list does not SSH. - [List firewall rules](https://orbit.nckrtl.com/docs/api-reference/firewall/list-firewall-rules.md): List named firewall rules for one node. - [Allow a firewall rule](https://orbit.nckrtl.com/docs/api-reference/firewall/allow-a-firewall-rule.md): Allow one named UFW rule through the gateway. - [Deny a firewall rule](https://orbit.nckrtl.com/docs/api-reference/firewall/deny-a-firewall-rule.md): Deny one named UFW rule through the gateway. - [Remove a firewall rule](https://orbit.nckrtl.com/docs/api-reference/firewall/remove-a-firewall-rule.md): Remove one named UFW rule through the gateway. - [List live UFW rules](https://orbit.nckrtl.com/docs/api-reference/firewall/list-live-ufw-rules.md): Reads `ufw status numbered` over WireGuard and classifies each IPv4 rule against the desired managed set and operator firewall records. Live rules that do not match are drift. Desired or operator rules absent from live are missing. An inactive, absent, or unreachable backend returns empty live and m… - [List Orbit's own firewall rules](https://orbit.nckrtl.com/docs/api-reference/firewall/list-orbits-own-firewall-rules.md): Returns the `orbit:` rules Orbit intends on the Node: WireGuard member trust, public SSH recovery only while no active role has closed it, then each active role, the task VM image peers on a task VM host, and Metrics. The list does not SSH. No request adds, changes, or removes one of these rules. - [fleet:rollout:status](https://orbit.nckrtl.com/docs/api-reference/fleet-rollout/fleet:rollout:status.md): Show the newest fleet rollout, each Node's result, and the Nodes it leaves out. - [fleet:rollout:resume](https://orbit.nckrtl.com/docs/api-reference/fleet-rollout/fleet:rollout:resume.md): Resume the halted fleet rollout. The Gateway runs it in orbit-fleet-converge.service. - [Scan installed packages](https://orbit.nckrtl.com/docs/api-reference/tools/scan-installed-packages.md): Reads installed Homebrew formulae, casks, and Vite+ global packages for the enrolled account. The response reports each manager scan state, safe package facts, dependency and adoption support, and the UTC inspection time. It stores nothing, creates no Tool row, takes no manager lock, and does not in… - [List Tool Managers](https://orbit.nckrtl.com/docs/api-reference/tools/list-tool-managers.md): List tool managers for a node. - [List Tools](https://orbit.nckrtl.com/docs/api-reference/tools/list-tools.md): List tools for a node. - [Install a Tool](https://orbit.nckrtl.com/docs/api-reference/tools/install-a-tool.md): Install a tool through the gateway. - [Adopt a Tool](https://orbit.nckrtl.com/docs/api-reference/tools/adopt-a-tool.md): Records Orbit ownership of one supported installed package. Send the Node, manager, package, and optional SemVer constraint. The call installs, updates, removes, and repins nothing. The same intent returns unchanged. A different constraint, a busy scope, a missing or unsupported package, or missing… - [Remove a Tool](https://orbit.nckrtl.com/docs/api-reference/tools/remove-a-tool.md): Remove one tool. - [Show a Tool](https://orbit.nckrtl.com/docs/api-reference/tools/show-a-tool.md): Show a tool. - [Update a Tool](https://orbit.nckrtl.com/docs/api-reference/tools/update-a-tool.md): Update one tool. - [Disable Metrics](https://orbit.nckrtl.com/docs/api-reference/metrics/disable-metrics.md): Disable Metrics. - [Enable Metrics](https://orbit.nckrtl.com/docs/api-reference/metrics/enable-metrics.md): Enable Metrics on one node. - [Show Metrics credentials](https://orbit.nckrtl.com/docs/api-reference/metrics/show-metrics-credentials.md): Show Metrics credentials. - [Reset Metrics credentials](https://orbit.nckrtl.com/docs/api-reference/metrics/reset-metrics-credentials.md) - [Disable an exporter](https://orbit.nckrtl.com/docs/api-reference/metrics/disable-an-exporter.md): Disable the Metrics exporter on a node. - [Enable an exporter](https://orbit.nckrtl.com/docs/api-reference/metrics/enable-an-exporter.md): Enable the Metrics exporter on a node. - [Show Metrics status](https://orbit.nckrtl.com/docs/api-reference/metrics/show-metrics-status.md): Show Metrics status. - [Remove the stored GitHub App](https://orbit.nckrtl.com/docs/api-reference/github-app/remove-the-stored-github-app.md): Delete the GitHub App credentials the Gateway stores. - [Show the GitHub App](https://orbit.nckrtl.com/docs/api-reference/github-app/show-the-github-app.md): Show the Gateway's GitHub App and the accounts that installed it. - [Start a GitHub App registration or installation](https://orbit.nckrtl.com/docs/api-reference/github-app/start-a-github-app-registration-or-installation.md): Register the GitHub App when the Gateway has none, then install it on a GitHub account. - [Clear the analytics Stats API key](https://orbit.nckrtl.com/docs/api-reference/analytics/clear-the-analytics-stats-api-key.md): Clears the stored Plausible Stats API key. - [Show analytics Stats API credentials](https://orbit.nckrtl.com/docs/api-reference/analytics/show-analytics-stats-api-credentials.md): Returns whether a Plausible Stats API key is stored. The key itself is never returned. - [Store the analytics Stats API key](https://orbit.nckrtl.com/docs/api-reference/analytics/store-the-analytics-stats-api-key.md): Stores a Plausible Stats API key as a protected Gateway setting. The key is never returned. - [Pin the Plausible version](https://orbit.nckrtl.com/docs/api-reference/analytics/pin-the-plausible-version.md): Pin another Plausible version for the analytics role. - [project:document-storage:show](https://orbit.nckrtl.com/docs/api-reference/projects/project:document-storage:show.md): Show private Project Document storage. - [project:document-storage:update](https://orbit.nckrtl.com/docs/api-reference/projects/project:document-storage:update.md): Update private Project Document storage. - [List Projects](https://orbit.nckrtl.com/docs/api-reference/projects/list-projects.md): List projects. - [Create a Project](https://orbit.nckrtl.com/docs/api-reference/projects/create-a-project.md): Create a project. - [Remove a Project](https://orbit.nckrtl.com/docs/api-reference/projects/remove-a-project.md): Remove a project. - [Show a Project](https://orbit.nckrtl.com/docs/api-reference/projects/show-a-project.md): Show a project. - [Update a Project](https://orbit.nckrtl.com/docs/api-reference/projects/update-a-project.md): Update a project. - [List development deploy steps](https://orbit.nckrtl.com/docs/api-reference/projects/list-development-deploy-steps.md): List a Project's development deploy steps. - [Create a development deploy step](https://orbit.nckrtl.com/docs/api-reference/projects/create-a-development-deploy-step.md): Record one named development deploy step on a Project. - [Remove a development deploy step](https://orbit.nckrtl.com/docs/api-reference/projects/remove-a-development-deploy-step.md): Remove one named development deploy step. - [Update a development deploy step](https://orbit.nckrtl.com/docs/api-reference/projects/update-a-development-deploy-step.md): Change one named development deploy step. - [project:document:list](https://orbit.nckrtl.com/docs/api-reference/projects/project:document:list.md): Project-scoped Documents. Requires ProjectOwning Node access. See /reference/project-documents for limits, archive inheritance, revision preconditions and retry recovery. No object keys or credentials are returned. - [project:document:create](https://orbit.nckrtl.com/docs/api-reference/projects/project:document:create.md): Project-scoped Documents. Requires ProjectOwning Node access. See /reference/project-documents for limits, archive inheritance, revision preconditions and retry recovery. No object keys or credentials are returned. - [project:document:search](https://orbit.nckrtl.com/docs/api-reference/projects/project:document:search.md): Project-scoped Documents. Requires ProjectOwning Node access. See /reference/project-documents for limits, archive inheritance, revision preconditions and retry recovery. No object keys or credentials are returned. - [project:document:destroy](https://orbit.nckrtl.com/docs/api-reference/projects/project:document:destroy.md): Project-scoped Documents. Requires ProjectOwning Node access. See /reference/project-documents for limits, archive inheritance, revision preconditions and retry recovery. No object keys or credentials are returned. - [project:document:show](https://orbit.nckrtl.com/docs/api-reference/projects/project:document:show.md): Project-scoped Documents. Requires ProjectOwning Node access. See /reference/project-documents for limits, archive inheritance, revision preconditions and retry recovery. No object keys or credentials are returned. - [project:document:update](https://orbit.nckrtl.com/docs/api-reference/projects/project:document:update.md): Project-scoped Documents. Requires ProjectOwning Node access. See /reference/project-documents for limits, archive inheritance, revision preconditions and retry recovery. No object keys or credentials are returned. - [project:document:archive](https://orbit.nckrtl.com/docs/api-reference/projects/project:document:archive.md): Project-scoped Documents. Requires ProjectOwning Node access. See /reference/project-documents for limits, archive inheritance, revision preconditions and retry recovery. No object keys or credentials are returned. - [project:document:read](https://orbit.nckrtl.com/docs/api-reference/projects/project:document:read.md): Project-scoped Documents. Requires ProjectOwning Node access. See /reference/project-documents for limits, archive inheritance, revision preconditions and retry recovery. No object keys or credentials are returned. - [project:document:write](https://orbit.nckrtl.com/docs/api-reference/projects/project:document:write.md): Project-scoped Documents. Requires ProjectOwning Node access. See /reference/project-documents for limits, archive inheritance, revision preconditions and retry recovery. No object keys or credentials are returned. - [project:document:download](https://orbit.nckrtl.com/docs/api-reference/projects/project:document:download.md): Project-scoped Documents. Requires ProjectOwning Node access. See /reference/project-documents for limits, archive inheritance, revision preconditions and retry recovery. No object keys or credentials are returned. - [project:document:restore](https://orbit.nckrtl.com/docs/api-reference/projects/project:document:restore.md): Project-scoped Documents. Requires ProjectOwning Node access. See /reference/project-documents for limits, archive inheritance, revision preconditions and retry recovery. No object keys or credentials are returned. - [project:document:restore-version](https://orbit.nckrtl.com/docs/api-reference/projects/project:document:restore-version.md): Project-scoped Documents. Requires ProjectOwning Node access. See /reference/project-documents for limits, archive inheritance, revision preconditions and retry recovery. No object keys or credentials are returned. - [project:document:version:list](https://orbit.nckrtl.com/docs/api-reference/projects/project:document:version:list.md): Project-scoped Documents. Requires ProjectOwning Node access. See /reference/project-documents for limits, archive inheritance, revision preconditions and retry recovery. No object keys or credentials are returned. - [project:excluded-node:list](https://orbit.nckrtl.com/docs/api-reference/projects/project:excluded-node:list.md): List the app-dev Nodes a Project cannot use for development. - [project:excluded-node:remove](https://orbit.nckrtl.com/docs/api-reference/projects/project:excluded-node:remove.md): Remove a development Node exclusion from a Project. - [project:excluded-node:add](https://orbit.nckrtl.com/docs/api-reference/projects/project:excluded-node:add.md): Exclude an app-dev Node from development placement for a Project. - [List process definitions](https://orbit.nckrtl.com/docs/api-reference/projects/list-process-definitions.md): Project-owned definitions carry the runtime specification that production preparation copies into a new Instance. Changing a definition changes Project configuration only. - [Create a process definition](https://orbit.nckrtl.com/docs/api-reference/projects/create-a-process-definition.md): Project-owned definitions carry the runtime specification that production preparation copies into a new Instance. Changing a definition changes Project configuration only. - [Remove a process definition](https://orbit.nckrtl.com/docs/api-reference/projects/remove-a-process-definition.md): Project-owned definitions carry the runtime specification that production preparation copies into a new Instance. Changing a definition changes Project configuration only. - [Show a process definition](https://orbit.nckrtl.com/docs/api-reference/projects/show-a-process-definition.md): Project-owned definitions carry the runtime specification that production preparation copies into a new Instance. Changing a definition changes Project configuration only. - [Replace a process definition](https://orbit.nckrtl.com/docs/api-reference/projects/replace-a-process-definition.md): Project-owned definitions carry the runtime specification that production preparation copies into a new Instance. Changing a definition changes Project configuration only. - [List Schedule definitions](https://orbit.nckrtl.com/docs/api-reference/projects/list-schedule-definitions.md): Project-owned definitions carry the runtime specification that production preparation copies into a new Instance. Changing a definition changes Project configuration only. - [Create a Schedule definition](https://orbit.nckrtl.com/docs/api-reference/projects/create-a-schedule-definition.md): Project-owned definitions carry the runtime specification that production preparation copies into a new Instance. Changing a definition changes Project configuration only. - [Remove a Schedule definition](https://orbit.nckrtl.com/docs/api-reference/projects/remove-a-schedule-definition.md): Project-owned definitions carry the runtime specification that production preparation copies into a new Instance. Changing a definition changes Project configuration only. - [Show a Schedule definition](https://orbit.nckrtl.com/docs/api-reference/projects/show-a-schedule-definition.md): Project-owned definitions carry the runtime specification that production preparation copies into a new Instance. Changing a definition changes Project configuration only. - [Replace a Schedule definition](https://orbit.nckrtl.com/docs/api-reference/projects/replace-a-schedule-definition.md): Project-owned definitions carry the runtime specification that production preparation copies into a new Instance. Changing a definition changes Project configuration only. - [instance:deployment:show](https://orbit.nckrtl.com/docs/api-reference/instances/instance:deployment:show.md): Show one recorded deployment, its phases and steps, and its log. - [List Instances](https://orbit.nckrtl.com/docs/api-reference/instances/list-instances.md): List instances. - [Create an Instance](https://orbit.nckrtl.com/docs/api-reference/instances/create-an-instance.md): Create a development Instance on an app-dev Node. - [Register an Instance](https://orbit.nckrtl.com/docs/api-reference/instances/register-an-instance.md): Adopt the current Git source as a managed Instance of an existing Project. - [instance:resolve](https://orbit.nckrtl.com/docs/api-reference/instances/instance:resolve.md) - [instance:resolve-directory](https://orbit.nckrtl.com/docs/api-reference/instances/instance:resolve-directory.md) - [Clone an Instance](https://orbit.nckrtl.com/docs/api-reference/instances/clone-an-instance.md): Clone a candidate into a prepared production Instance. - [Remove an Instance](https://orbit.nckrtl.com/docs/api-reference/instances/remove-an-instance.md): Destroy an Instance. - [Show an Instance](https://orbit.nckrtl.com/docs/api-reference/instances/show-an-instance.md): Show an instance. - [Update the deployment branch](https://orbit.nckrtl.com/docs/api-reference/instances/update-the-deployment-branch.md): Update a production Instance deployment branch. - [Remove Instance tracking hosts](https://orbit.nckrtl.com/docs/api-reference/instances/remove-instance-tracking-hosts.md): Remove the analytics tracking hosts of an Instance. - [Show Instance analytics](https://orbit.nckrtl.com/docs/api-reference/instances/show-instance-analytics.md): Show the analytics tracking hosts of an Instance. - [Publish Instance tracking hosts](https://orbit.nckrtl.com/docs/api-reference/instances/publish-instance-tracking-hosts.md): Publish the analytics tracking hosts of an Instance. - [Read Instance analytics stats](https://orbit.nckrtl.com/docs/api-reference/instances/read-instance-analytics-stats.md): Returns live visitors, visitors for Plausible's day, 7-day, and 30-day periods, and the top ten pages for the Instance's tracked site. `available` is false when the analytics role is not active or the Instance has no tracking host. A failed Stats API read is `readable: false` with no visitor numbers… - [Detach a Database connection](https://orbit.nckrtl.com/docs/api-reference/instances/detach-a-database-connection.md): Remove a Database connection from an Instance and clear stored environment keys. - [Attach a Database connection](https://orbit.nckrtl.com/docs/api-reference/instances/attach-a-database-connection.md): Add a Database connection on an Instance and write stored environment keys. - [instance:dependencies:show](https://orbit.nckrtl.com/docs/api-reference/instances/instance:dependencies:show.md) - [instance:dependencies:scan](https://orbit.nckrtl.com/docs/api-reference/instances/instance:dependencies:scan.md): Scan root dependency manifests and lockfiles for one instance or every authorized instance. - [instance:dependencies:update](https://orbit.nckrtl.com/docs/api-reference/instances/instance:dependencies:update.md): Update development root packages within declared constraints and refresh inventory. - [Deploy an Instance](https://orbit.nckrtl.com/docs/api-reference/instances/deploy-an-instance.md): Deploy a production Instance or an app-dev default Instance. - [List deploy steps](https://orbit.nckrtl.com/docs/api-reference/instances/list-deploy-steps.md): List deploy steps on a production Instance. - [Create a deploy step](https://orbit.nckrtl.com/docs/api-reference/instances/create-a-deploy-step.md): Create a named deploy step on a production Instance. - [Remove a deploy step](https://orbit.nckrtl.com/docs/api-reference/instances/remove-a-deploy-step.md): Destroy a named deploy step on a production Instance. - [Update a deploy step](https://orbit.nckrtl.com/docs/api-reference/instances/update-a-deploy-step.md): Update a named deploy step on a production Instance. - [instance:deployment:list](https://orbit.nckrtl.com/docs/api-reference/instances/instance:deployment:list.md): List recorded Instance deployment history, newest first. - [Open a live Instance log stream](https://orbit.nckrtl.com/docs/api-reference/instances/open-a-live-instance-log-stream.md): Opens a live log stream of the Instance's application log for one Reverb socket, with the access rule of `instance:logs`. The response signs the socket's subscription to `private-log-stream.{id}`; the Gateway then relays redacted lines from the Node agent there as `log.lines` events. Returns `logs.l… - [Close a live Instance log stream](https://orbit.nckrtl.com/docs/api-reference/instances/close-a-live-instance-log-stream.md): Closes a live Instance log stream at once and publishes `log.ended` with reason `closed`. Only the Node that opened the stream can close it. - [Renew a live Instance log stream](https://orbit.nckrtl.com/docs/api-reference/instances/renew-a-live-instance-log-stream.md): Extends the lease of a live Instance log stream to 60 seconds from now. Only the Node that opened the stream can renew it. Does not record Activity. - [Read Instance logs](https://orbit.nckrtl.com/docs/api-reference/instances/read-instance-logs.md): Returns one redacted tail of the Instance's application log, `storage/logs/laravel.log` or the newest `laravel-*.log`, read over SSH. `lines` is 1 to 1,000, default 100. Open a live log stream to follow new lines. - [Read the Instance queue](https://orbit.nckrtl.com/docs/api-reference/instances/read-the-instance-queue.md) - [List retained releases](https://orbit.nckrtl.com/docs/api-reference/instances/list-retained-releases.md): List retained production Instance releases. - [instance:rename](https://orbit.nckrtl.com/docs/api-reference/instances/instance:rename.md): Record a development branch rename and move its Route. - [Roll back an Instance](https://orbit.nckrtl.com/docs/api-reference/instances/roll-back-an-instance.md): Select one retained production Instance release. - [instance:setup](https://orbit.nckrtl.com/docs/api-reference/instances/instance:setup.md): Run the Project setup steps for one development Instance. - [Transfer an Instance](https://orbit.nckrtl.com/docs/api-reference/instances/transfer-an-instance.md): Transfer a development Instance to another app-dev Node. - [instance:setup-step:list](https://orbit.nckrtl.com/docs/api-reference/instances/instance:setup-step:list.md): List a Project's setup steps. - [instance:setup-step:create](https://orbit.nckrtl.com/docs/api-reference/instances/instance:setup-step:create.md): Record one named setup step on a Project. - [instance:setup-step:destroy](https://orbit.nckrtl.com/docs/api-reference/instances/instance:setup-step:destroy.md): Remove one named setup step. - [instance:setup-step:update](https://orbit.nckrtl.com/docs/api-reference/instances/instance:setup-step:update.md): Change one named setup step. - [instance:teardown-step:list](https://orbit.nckrtl.com/docs/api-reference/instances/instance:teardown-step:list.md): List a Project's teardown steps. - [instance:teardown-step:create](https://orbit.nckrtl.com/docs/api-reference/instances/instance:teardown-step:create.md): Record one named teardown step on a Project. - [instance:teardown-step:destroy](https://orbit.nckrtl.com/docs/api-reference/instances/instance:teardown-step:destroy.md): Remove one named teardown step. - [instance:teardown-step:update](https://orbit.nckrtl.com/docs/api-reference/instances/instance:teardown-step:update.md): Change one named teardown step. - [Import the environment file](https://orbit.nckrtl.com/docs/api-reference/environment/import-the-environment-file.md): Import the workload environment file into stored Instance configuration. - [Synchronize the environment file](https://orbit.nckrtl.com/docs/api-reference/environment/synchronize-the-environment-file.md): Synchronize stored Instance configuration to the workload environment file. - [Update an environment value](https://orbit.nckrtl.com/docs/api-reference/environment/update-an-environment-value.md): Update one stored Instance environment value without changing the workload file. - [List Routes](https://orbit.nckrtl.com/docs/api-reference/routes/list-routes.md): List Routes. - [Create a Route](https://orbit.nckrtl.com/docs/api-reference/routes/create-a-route.md): Create an explicit Route. - [Remove a Route](https://orbit.nckrtl.com/docs/api-reference/routes/remove-a-route.md): Remove a Route. - [Show a Route](https://orbit.nckrtl.com/docs/api-reference/routes/show-a-route.md): Show a Route. - [Update a Route](https://orbit.nckrtl.com/docs/api-reference/routes/update-a-route.md): Update a Route. - [Clear the Route target](https://orbit.nckrtl.com/docs/api-reference/routes/clear-the-route-target.md): Clear the configured Route target. - [Set the Route target](https://orbit.nckrtl.com/docs/api-reference/routes/set-the-route-target.md): Set the configured Route target or a complete production target set. - [List Database connections](https://orbit.nckrtl.com/docs/api-reference/database-connections/list-database-connections.md): List registered Database connections. - [Create a Database connection](https://orbit.nckrtl.com/docs/api-reference/database-connections/create-a-database-connection.md): Registers an existing database, or with `server` creates a MySQL database and user on that Database server. `server` excludes every connection field; `instance_id` makes that Instance the owner, creates the test database, and attaches the connection under prefix DB. The response never contains a pas… - [Remove a Database connection](https://orbit.nckrtl.com/docs/api-reference/database-connections/remove-a-database-connection.md): Destroy a Database connection. - [Show a Database connection](https://orbit.nckrtl.com/docs/api-reference/database-connections/show-a-database-connection.md): Show one Database connection. - [Update a Database connection](https://orbit.nckrtl.com/docs/api-reference/database-connections/update-a-database-connection.md): Update a Database connection. - [Describe a Database table](https://orbit.nckrtl.com/docs/api-reference/database-connections/describe-a-database-table.md): Shows columns for one table on a registered Database connection. An unknown table returns database.table_missing. - [Query a Database connection](https://orbit.nckrtl.com/docs/api-reference/database-connections/query-a-database-connection.md): Runs one SQL statement against a registered Database connection. Query is read-only unless the body sets write to true. SQLite runs on the associated Node. Responses omit passwords and replace a password-shaped value with [REDACTED]. - [Show a Database connection schema](https://orbit.nckrtl.com/docs/api-reference/database-connections/show-a-database-connection-schema.md): Shows columns for every table on a registered Database connection. SQLite inspection runs on the associated Node. - [List Database connection tables](https://orbit.nckrtl.com/docs/api-reference/database-connections/list-database-connection-tables.md): Lists tables on a registered Database connection. SQLite inspection runs on the associated Node. - [database:user:list](https://orbit.nckrtl.com/docs/api-reference/database-connections/database:user:list.md): List the recorded users for a registered Database connection. - [Add a database user](https://orbit.nckrtl.com/docs/api-reference/database-connections/add-a-database-user.md): Adds a user to a database on a Database server, or sets the password and privileges of an existing one. `read_only` grants SELECT; otherwise the user gets all privileges on the database. A connection without a server returns `database.server_required`. The username of a connection on the server retu… - [List Database servers](https://orbit.nckrtl.com/docs/api-reference/database-connections/list-database-servers.md): List the Database servers. - [Create a Database server](https://orbit.nckrtl.com/docs/api-reference/database-connections/create-a-database-server.md): Runs a MySQL server as a Docker Node Process. The Gateway generates the root password, passes it to the container for the first start only, and then keeps it only encrypted. A retry of the same request continues from the first step that did not finish; another Node, tag, or port for an existing slug… - [Remove a Database server](https://orbit.nckrtl.com/docs/api-reference/database-connections/remove-a-database-server.md): Removes the Process and the record of a Database server that no connection uses. The data volume stays on the Node. A server that a connection points to returns `database.server_in_use`. - [Show a Database server](https://orbit.nckrtl.com/docs/api-reference/database-connections/show-a-database-server.md): Shows one Database server with the connections of the databases on it. - [List Processes](https://orbit.nckrtl.com/docs/api-reference/processes/list-processes.md): List processes for one Instance or Node, or process definitions for one Project. - [Create a Process](https://orbit.nckrtl.com/docs/api-reference/processes/create-a-process.md): Create one systemd service, Docker container process, or Project process definition. - [Remove a Process](https://orbit.nckrtl.com/docs/api-reference/processes/remove-a-process.md): Destroy one process or Project process definition. - [process:update](https://orbit.nckrtl.com/docs/api-reference/processes/process:update.md): Replace an installed Process specification or one Project process definition. - [Open a live Process log stream](https://orbit.nckrtl.com/docs/api-reference/processes/open-a-live-process-log-stream.md): Opens a live log stream of the Process's journal or container output for one Reverb socket, with the access rule of `process:logs`. The response signs the socket's subscription to `private-log-stream.{id}`; the Gateway then relays redacted lines from the Node agent there as `log.lines` events. Retur… - [Close a live Process log stream](https://orbit.nckrtl.com/docs/api-reference/processes/close-a-live-process-log-stream.md): Closes a live Process log stream at once and publishes `log.ended` with reason `closed`. Only the Node that opened the stream can close it. - [Renew a live Process log stream](https://orbit.nckrtl.com/docs/api-reference/processes/renew-a-live-process-log-stream.md): Extends the lease of a live Process log stream to 60 seconds from now. Only the Node that opened the stream can renew it. Does not record Activity. - [Read Process logs](https://orbit.nckrtl.com/docs/api-reference/processes/read-process-logs.md): Returns one redacted tail of the Process's journal or container output, read over SSH. `lines` is 1 to 1,000, default 100. Open a live log stream to follow new lines. - [Restart a Process](https://orbit.nckrtl.com/docs/api-reference/processes/restart-a-process.md): Restart one process. - [Start a Process](https://orbit.nckrtl.com/docs/api-reference/processes/start-a-process.md): Start one process. - [Stop a Process](https://orbit.nckrtl.com/docs/api-reference/processes/stop-a-process.md): Stop one process. - [List Schedules](https://orbit.nckrtl.com/docs/api-reference/schedules/list-schedules.md): List authorized Schedules or Project Schedule definitions. - [Create a Schedule](https://orbit.nckrtl.com/docs/api-reference/schedules/create-a-schedule.md): Create one Node or Instance Schedule, or a Project Schedule definition. - [Remove a Schedule](https://orbit.nckrtl.com/docs/api-reference/schedules/remove-a-schedule.md): Destroy one Schedule or Project Schedule definition through the Gateway. - [Show a Schedule](https://orbit.nckrtl.com/docs/api-reference/schedules/show-a-schedule.md): Show one authorized Schedule or Project Schedule definition. - [Enable a Schedule](https://orbit.nckrtl.com/docs/api-reference/schedules/enable-a-schedule.md): Enable and start one installed Instance Schedule timer. - [Read Schedule logs](https://orbit.nckrtl.com/docs/api-reference/schedules/read-schedule-logs.md): Return one bounded Schedule log tail. - [Run a Schedule](https://orbit.nckrtl.com/docs/api-reference/schedules/run-a-schedule.md): Run one Schedule without changing its timer state. - [annotation:list](https://orbit.nckrtl.com/docs/api-reference/annotations/annotation:list.md) - [annotation:create](https://orbit.nckrtl.com/docs/api-reference/annotations/annotation:create.md) - [annotation:events](https://orbit.nckrtl.com/docs/api-reference/annotations/annotation:events.md) - [annotation:retry](https://orbit.nckrtl.com/docs/api-reference/annotations/annotation:retry.md) - [annotation:update](https://orbit.nckrtl.com/docs/api-reference/annotations/annotation:update.md) - [tasks:definition:create](https://orbit.nckrtl.com/docs/api-reference/tasks/tasks:definition:create.md): Stores a task definition for a Project. The body is the whole definition. Gateway access is required. The call does not start a task. An invalid definition returns `tasks.definition_invalid` (422), and `details.rules` names each failing rule and the subtask key. A name the Project already uses retur… - [tasks:definition:destroy](https://orbit.nckrtl.com/docs/api-reference/tasks/tasks:definition:destroy.md): Deletes a task definition and returns it. The call does not delete a task and does not start one. Gateway access is required. Returns `extension.disabled` while the tasks extension is off. - [tasks:definition:show](https://orbit.nckrtl.com/docs/api-reference/tasks/tasks:definition:show.md): Shows one task definition. Any authorized peer can show it. The call does not start a task. Returns `extension.disabled` while the tasks extension is off. - [tasks:definition:update](https://orbit.nckrtl.com/docs/api-reference/tasks/tasks:definition:update.md): Replaces a task definition. The body is the whole definition. It may omit `name`; the path then supplies it. A body `name` that differs from the path is refused. Gateway access is required. The call does not start a task. An invalid definition returns `tasks.definition_invalid` (422). Returns `exten… - [tasks:definition:list](https://orbit.nckrtl.com/docs/api-reference/tasks/tasks:definition:list.md): Lists task definitions, optionally filtered by numeric `project_id`. Any authorized peer can list them. The call does not start a task. Returns `extension.disabled` while the tasks extension is off. - [List Task groups](https://orbit.nckrtl.com/docs/api-reference/tasks/list-task-groups.md): Lists Task groups, newest first. Optional `project_id` and `status` filters. The group and each subtask include `assistance_requested`, `assistance_kind`, `assistance_question`, and `assistance_reason`. Returns `extension.disabled` while the extension is off. - [Create a Task group](https://orbit.nckrtl.com/docs/api-reference/tasks/create-a-task-group.md): Creates a Task group for a Project with an optional ordered list of Task subtasks. Requires Gateway access. `status` is `backlog` (the default) or `todo`; the scheduler never claims a `backlog` group. A `todo` group needs at least one subtask (`tasks.no_subtasks`), each with at least one deliverable… - [Show a Task group](https://orbit.nckrtl.com/docs/api-reference/tasks/show-a-task-group.md): Shows one Task group and its Tasks in position order. The group and each subtask include `assistance_requested`, `assistance_kind`, `assistance_question`, and `assistance_reason`. Returns `extension.disabled` while the extension is off. - [Update a Task group](https://orbit.nckrtl.com/docs/api-reference/tasks/update-a-task-group.md): Updates a Task group. `title` and `brief` change only in `backlog` (`tasks.not_in_backlog`). `status` moves the group between `backlog` and `todo`; a claimed group cannot move (`tasks.already_claimed`), and `todo` needs at least one subtask (`tasks.no_subtasks`) and a deliverable on every subtask (`… - [List task agent sessions](https://orbit.nckrtl.com/docs/api-reference/tasks/list-task-agent-sessions.md): List a task group's agent threads. - [Watch a task agent session](https://orbit.nckrtl.com/docs/api-reference/tasks/watch-a-task-agent-session.md) - [Cancel a Task group](https://orbit.nckrtl.com/docs/api-reference/tasks/cancel-a-task-group.md): Cancels a backlog, todo, reserved, running, reviewing, or failed Task group, or a settling group without a pull request, and clears its shared Instance. For a settling group with an approved subtask, the Gateway first pushes the workspace HEAD to `task-{group}` on origin; a failed push returns `task… - [Complete a Task group](https://orbit.nckrtl.com/docs/api-reference/tasks/complete-a-task-group.md): Completes a settling Task group or a VM group waiting for review without reading GitHub, or a running or reviewing group whose watched pull request has merged or closed. Stores the ended state in watched_pr_completion before cancelling open subtasks and completing the group in one transaction. Stops… - [Create a subtask](https://orbit.nckrtl.com/docs/api-reference/tasks/create-a-subtask.md): Appends one subtask to a Task group at the next position with status `todo`. Works in any group status except `completed` and `cancelled` (`tasks.group_closed`). `deliverables` is a list of at most five typed items the subtask must deliver, each with a unique slug `id`, a `type`, and a `description`… - [Destroy a subtask](https://orbit.nckrtl.com/docs/api-reference/tasks/destroy-a-subtask.md): Deletes a subtask while its group is in `backlog` (`tasks.not_in_backlog`) and closes the position gap. Returns the deleted subtask. Served by the Node that holds the group's Instance, or by the Gateway for a group without one. Returns `extension.disabled` while the extension is off. - [Update a subtask](https://orbit.nckrtl.com/docs/api-reference/tasks/update-a-subtask.md): Updates a subtask `title`, `brief`, or `position` while its group is in `backlog` (`tasks.not_in_backlog`). In `todo`, `running`, `reviewing`, `settling`, or `waiting_for_review`, those fields change only while the subtask is `todo`; positions stay in the todo tail and cannot cross a started or fini… - [Cancel a todo or running subtask](https://orbit.nckrtl.com/docs/api-reference/tasks/cancel-a-todo-or-running-subtask.md): Cancels a `todo` or `running` subtask. A `todo` subtask may be cancelled when its group is `todo`, `running`, `reviewing`, `settling`, or `waiting_for_review`; this marks it cancelled with `settled_at`, starts nothing, and requests no assistance. If no open subtask remains, including reserved, runni… - [tasks:check:cancel](https://orbit.nckrtl.com/docs/api-reference/tasks/tasks:check:cancel.md) - [tasks:comment:list](https://orbit.nckrtl.com/docs/api-reference/tasks/tasks:comment:list.md): List a subtask's comments, newest first. - [tasks:comment:create](https://orbit.nckrtl.com/docs/api-reference/tasks/tasks:comment:create.md): Ask for assistance on a subtask or resolve a request. - [List task questions](https://orbit.nckrtl.com/docs/api-reference/tasks/list-task-questions.md): Lists task questions, newest first. Optional `project_id`, `cause`, `status`, and `since` filters. `since` is an ISO date and includes questions asked at that moment. Returns `extension.disabled` while the extension is off. - [Close a task question](https://orbit.nckrtl.com/docs/api-reference/tasks/close-a-task-question.md): Closes an `open` or `escalated` question as `answered` or `superseded`, with the operator's `reason` (1 to 2,000 characters) as its answer and `answered_by` `operator`. Orbit posts one `question_closed` comment on the subtask. Closing delivers no resolution, changes no assistance flag, and counts no… - [Show Tasks status](https://orbit.nckrtl.com/docs/api-reference/tasks/show-tasks-status.md): Returns whether the Gateway tasks extension is enabled, and every group currently asking for assistance. `assistance` lists those groups in ascending id order, each with its id, Project, title, status, `assistance_kind`, `assistance_question`, and `assistance_reason`. The list is present while the e… - [List extensions](https://orbit.nckrtl.com/docs/api-reference/extensions/list-extensions.md): Returns the Gateway-wide extension switch state as an object keyed by extension slug. The initial slugs are `tasks` and `proxycli`. - [Disable an extension](https://orbit.nckrtl.com/docs/api-reference/extensions/disable-an-extension.md): Disables one Gateway-wide extension without removing its setup data. Use `tasks` or `proxycli`; an unknown slug returns `validation.failed` (422). Returns the extension name and `enabled: false`. - [Enable an extension](https://orbit.nckrtl.com/docs/api-reference/extensions/enable-an-extension.md): Enable a Gateway extension for every client. Use `tasks` or `proxycli`; an unknown slug returns `validation.failed` (422). Returns the extension name and `enabled: true`. - [Run Doctor](https://orbit.nckrtl.com/docs/api-reference/doctor/run-doctor.md): Verify registered node state without making repairs. - [List Activities](https://orbit.nckrtl.com/docs/api-reference/activities/list-activities.md): List recent gateway command activity. - [Show an Activity](https://orbit.nckrtl.com/docs/api-reference/activities/show-an-activity.md): Show one gateway command activity attempt. - [Tear down proxycli](https://orbit.nckrtl.com/docs/api-reference/proxycli/tear-down-proxycli.md): Stops the collector Process for the whole fleet, withdraws collector.cli-proxy-api.orbit and its certificate, deletes the stored CLIProxyAPI management key and the read and control tokens, and hides provider reads. Setting up again needs the management key. The Redis connection and Valkey data stay. - [Show proxycli status](https://orbit.nckrtl.com/docs/api-reference/proxycli/show-proxycli-status.md): Returns whether the fleet feature is enabled, which Node and cache connection it uses, and when the snapshot was last written. - [Set up proxycli](https://orbit.nckrtl.com/docs/api-reference/proxycli/set-up-proxycli.md): Deploys one collector Process and publishes https://collector.cli-proxy-api.orbit after a Redis Database connection for shared Valkey is in place. Fails closed when that connection is missing, is not Redis, or names a Node without the database role. A custom proxy Route that already serves the colle… - [Update a proxycli account](https://orbit.nckrtl.com/docs/api-reference/proxycli/update-a-proxycli-account.md): Patches CLIProxyAPI account status, then recompiles pools from the cached snapshot without fetching quota. - [List proxycli models](https://orbit.nckrtl.com/docs/api-reference/proxycli/list-proxycli-models.md): Returns the models CLIProxyAPI offers, each as `id` and `provider`, from the collector snapshot. The request never calls CLIProxyAPI. A snapshot with no models returns an empty list. Returns `proxycli.disabled` while the collector is not set up. - [List proxycli providers](https://orbit.nckrtl.com/docs/api-reference/proxycli/list-proxycli-providers.md): Returns provider pools from the Valkey snapshot. The request never calls CLIProxyAPI. - [Show a proxycli provider](https://orbit.nckrtl.com/docs/api-reference/proxycli/show-a-proxycli-provider.md): Returns one provider pool and its accounts from the Valkey snapshot. Window titles are duration labels. A missing window is omitted. - [Tear down Vaultwarden](https://orbit.nckrtl.com/docs/api-reference/vaultwarden/tear-down-vaultwarden.md): Permanently deletes every Orbit item in the collection, recorded or not, unless `keep_items` is true, then the stored setup. A failed deletion keeps the setup, so the teardown can run again. Returns `vault.not_configured` (409). - [Show the Vaultwarden status](https://orbit.nckrtl.com/docs/api-reference/vaultwarden/show-the-vaultwarden-status.md): Returns the Vaultwarden setup and the state of the published Database items from the Gateway records. It never contacts Vaultwarden and never returns a secret. - [Set up Vaultwarden](https://orbit.nckrtl.com/docs/api-reference/vaultwarden/set-up-vaultwarden.md): Logs in to Vaultwarden with the account API key, unlocks it with the master password, finds the organization and collection by name or ID, and checks that the account can write to the collection. Only then stores the values, encrypted. `url` must be an HTTPS origin on a `.orbit` host, and the Gatewa… - [Sync database credentials to Vaultwarden](https://orbit.nckrtl.com/docs/api-reference/vaultwarden/sync-database-credentials-to-vaultwarden.md): Runs the Vaultwarden sync now: creates, rewrites, or permanently deletes Database items; adopts Orbit items with no ledger row; deletes duplicates, trashed copies, and items whose source is gone; and rewrites items changed in Vaultwarden. Returns the status when every change succeeded, and `vault.sy… - [List T3 servers](https://orbit.nckrtl.com/docs/api-reference/conn/list-t3-servers.md): Lists registered T3 servers with their URL, server version, registration time, and admin session expiry. `status` is `session_expired` when the server must register again. - [Register a T3 server](https://orbit.nckrtl.com/docs/api-reference/conn/register-a-t3-server.md): Called from a T3 server's host on startup with an admin session from `t3 auth session issue --label "Orbit Gateway"`. The Gateway checks that `url` serves `environment_id` and that T3 accepts `admin_session` with admin scopes, stores the session encrypted, and revokes its earlier sessions on that se… - [List pairings on a T3 server](https://orbit.nckrtl.com/docs/api-reference/conn/list-pairings-on-a-t3-server.md): Lists the pairing links the Gateway minted on one T3 server, newest first, with the Node and revocation time of each. - [Mint a pairing link](https://orbit.nckrtl.com/docs/api-reference/conn/mint-a-pairing-link.md): Mints a one-time pairing link on the T3 server for the calling Node and records it. Open `pairing_url` in Conn to pair. An expired admin session returns `conn.session_expired` (409). - [Revoke a Node's sessions on a T3 server](https://orbit.nckrtl.com/docs/api-reference/conn/revoke-a-nodes-sessions-on-a-t3-server.md): Revokes the sessions a Node paired from its links on one T3 server, and its unused links. Without `node_id` it revokes the calling Node. WireGuard access does not change. - [Show the calling Node](https://orbit.nckrtl.com/docs/api-reference/conn/show-the-calling-node.md): Returns the calling Node and the profile it is bound to, or `null`. Every active Node, a phone included, may use the Conn endpoints without a node access grant. - [Bind the calling Node to a profile](https://orbit.nckrtl.com/docs/api-reference/conn/bind-the-calling-node-to-a-profile.md): Binds the calling Node to one profile, replacing an earlier binding. Returns the Node and its profile. - [List Conn profiles](https://orbit.nckrtl.com/docs/api-reference/conn/list-conn-profiles.md): Lists every Conn profile. Every Node sees every profile. - [Create a Conn profile](https://orbit.nckrtl.com/docs/api-reference/conn/create-a-conn-profile.md): Creates a profile with an empty settings document at version 1. A taken name returns `validation.failed` (422). - [Show profile settings](https://orbit.nckrtl.com/docs/api-reference/conn/show-profile-settings.md): Returns the profile settings document, its version, and when it last changed. `sections` lists the sections that were written (`workspaces`, `appearance`, `devices.`) with their version, the time of the last write, and the name of the Node that wrote it. A section that is not listed is at vers… - [Patch profile settings sections](https://orbit.nckrtl.com/docs/api-reference/conn/patch-profile-settings-sections.md): Changes sections of the settings document, each with the version the client last read: `{"sections": {"appearance": {"version": 3, "value": {...}}, "devices.iphone": {"version": 0, "value": null}}}`. A section is `workspaces`, `appearance`, or `devices.`; an unknown name returns `validation.fa… - [Replace profile settings sections](https://orbit.nckrtl.com/docs/api-reference/conn/replace-profile-settings-sections.md): Replaces the sections of the settings document that the body holds (`workspaces`, `appearance`, `devices`; at least one) and keeps the others. `devices` replaces every device type and must hold at least one; a patch removes one type. Send the document version you last read; a stale version returns `… - [Authorize the orbit broadcast channel](https://orbit.nckrtl.com/docs/api-reference/realtime/authorize-the-orbit-broadcast-channel.md): A Pusher-protocol channel authorization endpoint. A client requests access to the private `orbit` channel with its `socket_id` and `channel_name`; any active WireGuard peer Node is authorized. - [Show the Reverb connection](https://orbit.nckrtl.com/docs/api-reference/realtime/show-the-reverb-connection.md): Returns the Reverb WebSocket URL, app key, and channel name a client needs to subscribe to record-change events, or null values when broadcasting is not configured. - [Authorize the agent's presence channel](https://orbit.nckrtl.com/docs/api-reference/node-callbacks/authorize-the-agents-presence-channel.md): The `orbit-agent` on a managed Node calls this endpoint to join its own presence channels. The Gateway signs member `agent.{id}` on `presence-node.{id}` or `presence-node-logs.{id}` only for a request from that Node's WireGuard address that carries the Node's agent secret. The response carries the P… - [List the live log streams the agent reads](https://orbit.nckrtl.com/docs/api-reference/node-callbacks/list-the-live-log-streams-the-agent-reads.md): The `orbit-agent` on a managed Node calls this endpoint to learn which logs to read for live log streams: when it joins its log channel, after each `log-streams.changed` event, and every 15 seconds while it reads a stream. The Gateway identifies the Node from the WireGuard address and the agent's be… - [Show the agent's Reverb connection](https://orbit.nckrtl.com/docs/api-reference/node-callbacks/show-the-agents-reverb-connection.md): The `orbit-agent` on a managed Node calls this endpoint to find its Reverb connection. The Gateway identifies the Node from the WireGuard address and the agent's bearer secret, and returns the Reverb URL, serving address, and app key, the Node's `presence-node.{id}` channel, and the agent's `agent.{… - [List the task checkouts the agent watches](https://orbit.nckrtl.com/docs/api-reference/node-callbacks/list-the-task-checkouts-the-agent-watches.md): The `orbit-agent` on a managed Node calls this endpoint every 60 seconds to learn which task checkouts to watch. The Gateway identifies the Node from the WireGuard address and the agent's bearer secret, and lists the Instances on that Node that hold the workspace of an unfinished task group, at most… - [Complete a GitHub App registration](https://orbit.nckrtl.com/docs/api-reference/node-callbacks/complete-a-github-app-registration.md) - [Serve the GitHub App manifest page](https://orbit.nckrtl.com/docs/api-reference/node-callbacks/serve-the-github-app-manifest-page.md) - [Authorize Grafana access](https://orbit.nckrtl.com/docs/api-reference/node-callbacks/authorize-grafana-access.md): Caddy on the Gateway calls this endpoint for each Grafana request. The Gateway identifies the caller from the connection address and answers 204 when the caller may reach Grafana. - [Wake an Instance](https://orbit.nckrtl.com/docs/api-reference/node-callbacks/wake-an-instance.md): Caddy on the Instance Node calls this endpoint when the awake marker is absent. The Gateway returns an HTML progress page and starts the desired-running Processes. - [Complete a Schedule run](https://orbit.nckrtl.com/docs/api-reference/node-callbacks/complete-a-schedule-run.md): The installed Schedule callback on the host Node reports the latest run. The Gateway accepts it only from the Schedule's recorded host Node and records `last_run_at` and `last_run_status`. - [Architecture decisions](https://orbit.nckrtl.com/docs/decisions/overview.md): Every architecture decision record behind Orbit, with its status and the records it extends or amends. - [ADR 0182: Start tasks from Project task definitions](https://orbit.nckrtl.com/docs/decisions/0182-start-tasks-from-project-task-definitions.md): In progress. A Task is one row in one tasks table, and its subtasks are child tasks. Each Project stores task definitions in the Gateway: ordered subtasks of five generic kinds, with forward routes on outcomes and declared parameters. Every task starts from a definition, now or at a scheduled time.… - [ADR 0190: Run MySQL servers with a Gateway-held admin password](https://orbit.nckrtl.com/docs/decisions/0190-run-mysql-servers-with-a-gateway-held-admin-password.md): In progress. database:server:create runs MySQL as a Docker Node Process and records a Database server. The generated root password is used only for the first start and then lives only encrypted in the Gateway. database:create --server creates a database and user on that server. - [ADR 0191: Clone the default Instance's database for each new Instance](https://orbit.nckrtl.com/docs/decisions/0191-clone-the-default-instance-database-for-each-new-instance.md): In progress. instance:create gives each new development Instance its own copy of the default Instance's database, of the same kind, plus a test database, and writes .env.testing. instance:destroy drops the copy. - [Derive the application directory from the web root](https://orbit.nckrtl.com/docs/decisions/0196-derive-application-directory-from-web-root.md): Separate a Laravel application's directory from its repository, and serve several web roots of one checkout through its Routes. - [0198 keep delivery line proofs as repo commands](https://orbit.nckrtl.com/docs/decisions/0198-keep-delivery-line-proofs-as-repo-commands.md) - [0200 run each task group in its own sandbox vm](https://orbit.nckrtl.com/docs/decisions/0200-run-each-task-group-in-its-own-sandbox-vm.md) - [ADR 0205: Publish database credentials to Vaultwarden](https://orbit.nckrtl.com/docs/decisions/0205-publish-database-credentials-to-vaultwarden.md): In progress. The Gateway copies every MySQL and PostgreSQL credential it holds into one Vaultwarden collection, as Database items that Vault and Conn read. Orbit stays the source of truth. - [ADR 0206: Build task VM images as chains of small jobs](https://orbit.nckrtl.com/docs/decisions/0206-build-task-vm-images-as-chains-of-small-jobs.md): In progress. The task VM base image is built by a chain of small queued jobs, one for each step, recorded in one image build row. Each build starts from the current image, and task VM enrollment trusts the image instead of a manifest. - [ADR 0207: One image recipe, shared package cache, no workspace templates](https://orbit.nckrtl.com/docs/decisions/0207-one-image-recipe-shared-package-cache-no-workspace-templates.md): In progress. One versioned recipe builds immutable task and role images and drives nightly production convergence; workspaces clone and install with a read-only host package cache. ## OpenAPI Specs - [openapi](/docs/openapi.json) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.