orrery v0.5.0

Orrery v0.5.0 — Hardening release

A full-application review — five perspectives (Python engine, Svelte/TS frontend, Rust/Tauri layer, an adversarial pass over the seams between them, and a docs/CI sweep) — followed by fixes for everything it surfaced. No new features: this release is about correctness, crash-safety, security, and making the docs tell the truth. If you run loops unattended, this is a recommended upgrade.

All suites green: 679 engine pytest · 240 Vitest · 93 Rust unit + 10-case reducer golden-parity · 9 Playwright e2e (now gated in CI).

🛡️ Guardrail integrity (engine)

The whole premise of Orrery is that an external gate — not the model — decides green. This release closes several ways that promise could quietly break:

• The test hash-lock now covers every configured lockGlobs pattern. Previously only the first pattern was locked, so in a multi-glob config (e.g. *.test.ts and *.spec.ts) an agent could rewrite the unlocked suite undetected. This is the most important fix in the release.
• A judge that returns a string failingCriteria (instead of a list) no longer refutes a genuinely-green verdict character-by-character.
• Quota survival can't spin forever. Non-probing runners (aider/codex) hitting a persistent rate limit are now capped at 4 blind waits, then surface as a real failure instead of an unbounded sleep-retry loop that bypassed maxIters and cost ceilings.
• Crash-safe state: checkpoint.json and text writes are atomic (temp + os.replace), and the state-dir lockfile is acquired atomically (O_CREAT|O_EXCL) — closing a race where two simultaneous starts both "won" the lock.
• A transient gh failure right after a BMAD merge degrades to the handoff path instead of crashing the driver mid-state-machine; all gh calls now carry a 120 s timeout.
• A bad numeric value in loop.json (ceilingUsd, maxIters, …) warns and keeps the default instead of aborting the load with a traceback.

🖥️ Desktop app (Rust / Tauri)

• LAN observe from your phone actually works now. The /ws path resolved a relative stateDir against the app's working directory instead of loops/<id>/, so a phone tailing any seeded loop saw an empty run forever. Fixed.
• Finished loop processes are reaped — no more zombie accumulation over a long desktop session.
• The log tailer is UTF-8-safe across read boundaries: a multibyte character flushed mid-write no longer corrupts (and silently drops) that event line.
• Security hardening: a start.program allowlist (defense-in-depth against a hostile loop.json), the LAN token moved out of the WebSocket URL into a Sec-WebSocket-Protocol header (so it can't leak via logs/history), and a restrictive Content-Security-Policy replacing csp: null.
• Blocking log reads and thread joins moved off the LAN server's async workers.

✨ App UI

Fast loop-switching can no longer flash the previous loop's state into the new view; a repeat verifier refutation re-surfaces the Verdict panel; the settings scope switcher is keyboard-navigable and external settings edits aren't clobbered by a focused field; the command palette keeps its selection across live ticks and surfaces run-control errors as a toast; a gate stage now requires a command; and several slow leaks (Observatory tracking maps, the alert chime's AudioContext) are fixed.

🧪 Tests, CI & docs

• CI now runs the Playwright e2e suite alongside the engine, unit, and Rust jobs.
• New golden case (guardrails) pins cross-reducer parity for the gate / handoff / plateau / parse_error events, which had zero coverage before.
• The README now states the default guardrail posture honestly (held-out verify + mutation audit are opt-in), with corrected test counts and fixed doc links; PROTOCOL documents the metrics field.
• The engine sources its version from __init__.py so app and package versions can't drift again. Dropped unused deps (@tauri-apps/plugin-opener, regex).

⚠️ Before you trust the bundles

The new CSP and the LAN subprotocol-token handshake are not exercisable by cargo test (Tauri hashes the inline bootstrap script only at bundle time). Give a built desktop bundle a quick manual smoke test — open a system, toggle theme, connect a phone over LAN — before relying on these binaries.

📦 Install

Grab a bundle from the assets below (orrery_0.5.0_*), or pip install orrery-loop for the engine alone. See the README for platform notes.

Full changelog: v0.4.0...v0.5.0

orrery v0.4.0

See CHANGELOG.md for details.

macOS builds are unsigned: after installing, run
xattr -cr /Applications/orrery.app or right-click → Open to bypass Gatekeeper.

orrery v0.3.0

See CHANGELOG.md for details.

macOS builds are unsigned: after installing, run
xattr -cr /Applications/orrery.app or right-click → Open to bypass Gatekeeper.

Orrery 0.2.0 — first public release

The first tagged release of Orrery: build, run, and watch autonomous Claude Code loops rendered as a living orbital star system.

Highlights

• Watchable loops: the desktop app (Tauri v2 + Svelte 5 + PixiJS) tails the engine's log.jsonl and renders epics as rings, stories as planets, quota pauses as polar night. Try it with zero cost: cd orrery && npm install && npm run dev replays recorded runs in your browser.
• Guarded engine: the Python engine drives the claude CLI with an external test gate, test-integrity hash-locks, held-out verify + mutation audit, cost ceilings, quota survival, and safe-stop checkpoints. Five console scripts: loop, loop-bmad, loop-qa, loop-supervise, loop-stop.
• Quality telemetry (new since 0.1.0): adversarial verify-before-merge, plan-gate, run-quality metrics — all default-on in the BMAD loop and all visible in the app.
• Open-source restructure: new README with screenshots and architecture diagram, generic seed templates (bmad, webapp-qa), portable paths, issue/PR templates.

Full details in CHANGELOG.md.

Status: alpha. Live loops spend real Claude quota/API money — read SECURITY.md before running unattended.

Orrery v0.1.0

First public release — a cross-platform Python loop engine plus the Orrery orbital visualizer.

Engine (engine/, pip install -e ./engine): a fix-until-green loop with an external test gate as truth, quota survival, crash recovery, and per-iteration git rollback. Pluggable agent backends (Claude / aider / codex). A generalized BMAD multi-story driver. Research-backed, default-off upgrades: held-out/hidden test split, compact first-failure feedback, cross-run lessons memory, mutation strength audit, and run-quality metrics.

Visualizer (orrery/): Tauri 2 + Svelte 5 + PixiJS — watch loops run as a live orbital animation.

Quality: 375 engine tests · 39 Rust + 7 vitest + 3 Playwright in the app · a cross-language reducer-parity golden harness · CI on Linux + Windows.

Alpha — APIs and the wire protocol may change before 1.0. See CHANGELOG.md for details and known limitations.