src/core/orchestrator.ts is the central turn-processing module, exporting the createOrchestrator factory, which wires together sessions, harness models, memory, skills, credentials, sandboxes, security screening, and delivery into a single Orchestrator instance.[1] src/core/orchestrator.ts re-exports egressClaimAllowingControlPlane, conversationLabelFor, filterConnectorSkills, and loadTapeImage from ./orchestrator/turn-helpers.ts, and re-exports the types Orchestrator, OrchestratorDeps, OrchestratorInput, and SurfaceContextPuller from ./orchestrator/types.ts — see Orchestrator types and deps and Turn helpers for the definitions those modules own.[1] src/core/wake-envelope.ts defines a WakeEnvelope type that wraps all externally-initiated resumes — webhooks, crons, and deep links — into a uniform shape for entry into the orchestrator run loop. The Auto-posture HiLO approval flow is a risk-tiered release mechanism in which tool results flagged as high or low risk are quarantined and suspended, awaiting explicit approval before execution resumes. src/core/orchestrator.ts routes tool-result quarantines triggered by the Auto-posture mechanism through a HiLO (High/Low risk) release approval flow; quarantined results suspend execution and await explicit approval before continuing. src/harness/mock-harness.ts supports the Auto-posture HiLO approval flow for testing, with coverage exercised in test/orchestrator.test.ts, test/pi-tools.test.ts, and test/slack-approval-cards.test.ts. src/types.ts carries additional fields on quarantined-content payloads to surface richer metadata; src/core/orchestrator.ts populates these fields when quarantining tool results through the Auto-posture HiLO flow. src/api/app-helpers.ts supports rendering of quarantined-content metadata; the web UI — plugins/web-ui/src/chat.ts, core-bridge.ts, and shell.css — uses this metadata to render expandable previews of blocked output. test/orchestrator.test.ts asserts on the expanded quarantined-content structure introduced by the richer metadata fields. In src/core/orchestrator.ts, the orchestrator passes the turn's surface name to the harness on every turn, ensuring multi-turn runs receive a current surface identifier rather than a blank or stale one. src/harness/mock-harness.ts captures the surface name passed by the orchestrator; test/orchestrator.test.ts asserts on this value to verify correct surface-name propagation across turns. Prompt-cache stability in Anthropic's API requires the system-prompt prefix to remain unchanged across turns; any mutation between turns invalidates the cache key and triggers full input-token billing on every subsequent turn. src/core/orchestrator.ts and src/harness/harness.ts pin the system prompt at session start and append turn-scoped additions as a stable suffix rather than mutating the prefix between turns, preserving Anthropic's prompt-cache key across calls. src/harness/context-compaction.ts, src/harness/pi-harness.ts, src/model/pi-models.ts, and src/harness/replay.ts support stable system-prompt construction; test/system-prompt-order.test.ts and test/pi-harness-cache-split.test.ts cover the ordering invariant. In Auto security posture, the orchestrator applies external tool-result egress screening exclusively to results from external tools; results from internal tools bypass screening. The orchestrator fails closed on tool-result egress classification: if provenance cannot be determined from the egress proxy stamp, the result is rejected rather than passed through with an unknown classification. Tool-result egress classification derives provenance from the egress proxy stamp rather than from command-text parsing or post-hoc egress accounting; this logic spans src/security/security-posture.ts, src/harness/agent-tools.ts, src/core/orchestrator.ts, src/connectors/background-exec-broker.ts, and src/tools/primitives.ts.
createOrchestrator falls back to in-memory stores when optional deps are absent: deps.approvals defaults to createMemoryMap<PendingApprovalRecord>(), deps.approvalGrants to createMemoryMap<CommandApprovalGrant>(), and deps.blobTransfer to createMemoryBlobTransferStore().[1]
Protocol-file constants are loaded once at module initialization: SHARED_CORE_MD, MODE_CONVERSATION_MD, MODE_AUTONOMOUS_MD, and MODE_FALLBACK_MD, each via loadProtocolFile.[1] The ACTIVITY_ENTRY_TYPES set classifies "tool_call", "tool_result", "approval_request", and "approval_resolved" as activity entries, distinguishing active-execution entries from conversational history.[1] First-block capture is capped at FIRST_BLOCK_CAPTURE_MAX_CHARS = 20_000 characters.[1]
The orchestrator maintains an LRU cache for the reachable-channel roster, keyed by principalId, with a TTL of 5 minutes and a maximum of INSTANCE_CACHE_MAX_ENTRIES (5,000) entries.[1] A separate LRU cache holds the directory member index, keyed by the string "org", sharing the same 5-minute TTL but capped at DIRECTORY_INDEX_CACHE_MAX_ENTRIES (100) entries.[1]
Sources