The Orchestrator interface defines three core methods (handleTurn, screenSecuritySteer, regenerateTitle) that implement the request-handling and security decision-making contract for QM's execution engine. OrchestratorDeps is the dependency-injection container wiring orchestrator operations; it requires core services (identity, sessions, workspace, sandbox, modelGateway, acl, memory) and accepts optional timeout, cache-mode, and AWS-role-brokering configuration.
The Orchestrator interface in src/core/orchestrator/types.ts exposes three methods: handleTurn (returns Promise<TurnResult>), screenSecuritySteer (returns Promise<"allow" | "block" | "unscreened">), and regenerateTitle.[1] The OrchestratorInput interface in src/core/orchestrator/types.ts extends TurnRequest via Omit and adds orchestrator-specific fields: origin: TurnOrigin, optional runId, attempt, finalAttempt, background, cancel: AbortSignal, queueMs, sessionParticipantIds, and scopeVersion.[1] The SurfaceContextPuller interface in src/core/orchestrator/types.ts has a required pull method and an optional searchLive method, both returning Promise<SurfaceContextResult | null>.[1]
OrchestratorDeps in src/core/orchestrator/types.ts is the dependency-injection bag for the orchestrator; required fields are identity, resolution, sessions, workspace, files, sandbox, modelGateway, auditLog, rateLimiter, harness, deploy, acl, and memory — nearly all other fields are optional.[1] The optional sessionTapeMode field of OrchestratorDeps accepts "shadow" or "serve", controlling how the session tape is accessed.[1] The optional layerBrokerFor function field of OrchestratorDeps maps a BrokeredLayerTool to an AwsRoleBroker | undefined, enabling AWS role brokering per deployment-layer tool.[1]
OrchestratorDeps includes optional timeout knobs: execTimeoutMs, execTimeoutCeilingMs, approvalSummaryTimeoutMs, and securityScreenTimeoutMs.[1] OrchestratorDeps also carries optional background-job TTL knobs: backgroundJobTtlMs and backgroundJobTtlMaxMs.[1]
Sources