The working machine.

Add the hooks (SessionStart, UserPromptSubmit, Stop, PreCompact, and SessionEnd for Claude Code) once. Inert until something is switched on.

Three scopes, each with off: every project (--global), this project (Git root), this terminal session (environment). Precedence: terminal → project → global → off. Stored switches persist.

Mid-task handoff point, same three scopes as on/off (built-in 350k). Stored in <home>/settings.json (section "handoff"): the command writes it, a hand edit applies at the next hook event, reset removes a stored point. Without a value: the point, where it came from, the settings file and the live context here.

Who types into a session's terminal (cmux, tmux): auto = Orbit types /clear at a handoff and wakes an idle session for a message; tell (default) = Orbit only tells.

A sender calls this right after delivering a message: the receiving session is woken when its input line is empty. Your own typing is never erased.

Hook installation, switches, handoff points and what applies in this folder.

Your normal command. The first substantial prompt becomes the goal; every prompt, correction, evidence and verdict lands in the ledger; the brief returns after compaction and at the next session.

Write a revision of the result goals and verification goals. Required after every requirement change before a claim; fixed checks are append-only.

Evidence per item: a command actually run (exit code and output tail), a file fingerprint, or a note.

At the handoff point: the next step and what the ledger cannot know. Then /clear or /new (typed by the user, or by Orbit in auto mode); the fresh session starts from it.

Completion claim: fixed checks run now; a failure returns to you; a pass queues one independent read-only review.

Keep the original goal and add this correction. Repeated --done explicitly replaces the checklist.

Print what the hooks inject: goal, corrections, checklist, evidence, last verdict, stop reason.

Render the ledger as a Markdown handoff. Nothing is written by hand.

Fix the goal, execute with the native CLI in an isolated clone, run fixed checks and independently test the completion claim.

Continue authorised queued work, pending reviews and interrupted calls after the terminal closes.

Continue after a pause, or stop at a safe boundary. A user pause is never cleared by recovery.

The same goals, evidence, checks, reviews and stop reasons as the terminal, for both entrances.

One model-free snapshot, or the full record of one task.

Recheck a claimed result now: fixed checks plus one independent review. Missing evidence is not completion.

Corrections repeated across tasks: candidates for a guard rule, counted from the ledger.

What this installation learned locally from the executor's decisions (never in the code), or forget it.

Maintainers: repeated Orbit defects fixed in a worktree behind four gates (checks, no personal traces, no vocabulary, general review).