Orkestera

Autonomy you can audit.
Start in Ork Chat or connect the clients your team uses. Give work a goal. Follow its progress, review the result, and inspect the usage it records.
Become a design partner Run it on your own infrastructure. Shape what ships next.
scroll ↓
The Status Quo

Your team uses several agents. You still need one place to understand the work.

Agents arrived in most engineering orgs from the bottom up, a seat at a time. Each one came with its own admin panel, its own spend limit and its own idea of what a log line is. The work they do is real. What is missing is the part that comes afterwards.

Nobody owns the record

Each tool logs to itself, in its own shape, behind its own login. Reconstructing what changed in a repository last Tuesday, and on whose authority, means four exports and a spreadsheet. The evidence exists; it was never assembled.

Cost arrives as a surprise

Spend lands on a monthly platform invoice, not against the work that caused it. By the time the number is visible the month is over, and no one can say which task, team or model is responsible for the shape of the curve.

Model choice is frozen by procurement

A model that worked well last quarter may no longer be your best choice. Comparing quality and cost is harder when each tool keeps its own evidence.

Governance is bolted on afterwards

A tracing tool sees model calls but not authorization. A governance platform sees policy but not execution. Neither runs the work, so both depend on the agent reporting itself accurately.

How it fits together

The control plane for agent-built software.

Follow work, client requests and usage records through the services that handle them.

The whole system, in motion

Illustrative request and record flow. Motion shows source-backed relationships, not live traffic.

Client requestsGoverned executionAnalytics history

The complete system is arranged vertically for your screen. Expand the relationship tables below for details.

Orkestera: connected services, clients and evidence stores 15 nodes connected by 31 relationships extracted from source. Top row: clients, identity and control. Middle row: ingress, execution and evidence services. Bottom row: producer records and Analytics object storage. Colored particles illustrate direction only; they do not indicate live traffic. Detailed relationships follow in the focused views. CLIENTS · IDENTITY · CONTROL INGRESS · EXECUTION · EVIDENCE PRODUCER RECORDS · ANALYTICS STORAGE Export client observations — external_client → client_edge. Telemetry-purpose credential; watch/client:ingest; observed identity. client_edge/internal/edge/telemetry.go:67; client_edge/internal/edge/telemetry.go:85; client_edge/internal/edge/telemetry.go:98; client_edge/internal/edge/telemetry.go:104 Exchange a telemetry credential — client_edge → auth. Edge service authentication; immutable purpose and current client grants. client_edge/main.go:100; client_edge/internal/edge/ingest.go:205; client_edge/internal/edge/ingest.go:213; auth/lib/auth/ingest_credential.ex:414 Forward verified client telemetry — client_edge → watch. Exchanged client token: aud=watch; client:ingest. client_edge/main.go:102; client_edge/internal/edge/telemetry.go:141; client_edge/internal/edge/telemetry.go:149; client_edge/internal/edge/telemetry.go:153 Copy terminal task metadata — watch → raw. Org Analytics entitlement; configured storage. watch/lib/watch/event_ingestor.ex:59; watch/lib/watch/task_history.ex:24; watch/lib/watch/task_history.ex:44; watch/lib/watch/task_history.ex:59; watch/lib/watch/task_history.ex:62 Read historical task metadata — watch → analytics. aud=analytics; analytics:read; verified org. watch/lib/watch/task_history.ex:256; watch/lib/watch/task_history.ex:258; analytics/internal/query/catalog.go:241; watch/lib/watch_web/live/task_timeline_live.ex:46 Native inference and tools — external_client → client_edge. aud=client_edge; inference:write; org/client claims. client_edge/internal/edge/edge.go:238; client_edge/internal/edge/edge.go:25; client_edge/internal/edge/edge.go:26; infra/cfn/alb.yml:305; infra/cfn/alb.yml:318; client_edge/internal/edge/edge.go:163; client_edge/internal/edge/edge.go:163 Report externally purchased usage — external_client → client_edge. aud=client_edge; inference:write; org/client claims. client_edge/internal/edge/edge.go:238; client_edge/internal/edge/edge.go:25; client_edge/internal/edge/edge.go:26; infra/cfn/alb.yml:305; infra/cfn/alb.yml:318; client_edge/internal/edge/edge.go:169; client_edge/internal/edge/edge.go:170 Replace auth and attribute from verified claims — client_edge → llmproxy. aud=llmproxy; internal:inference; client attribution headers rebuilt. client_edge/internal/edge/tokens.go:39; client_edge/internal/edge/tokens.go:40; client_edge/internal/edge/edge.go:136; client_edge/internal/edge/edge.go:142; llmproxy/internal/proxy/edge.go:62 Persist native completion — llmproxy → inference_store. Producer-owned storage. llmproxy/internal/proxy/proxy.go:1095 Persist reported usage separately — llmproxy → inference_store. Verified client attribution. llmproxy/internal/proxy/edge.go:152; llmproxy/internal/proxy/edge.go:156; llmproxy/internal/proxy/edge.go:165 Copy completed inference usage — inference_store → raw. Producer storage IAM; org Analytics entitlement. llmproxy/internal/proxy/proxy.go:1102; llmproxy/internal/analytics/row.go:248; llmproxy/internal/analytics/row.go:122; llmproxy/internal/analytics/sink.go:382; llmproxy/internal/analytics/sink.go:410 Copy acknowledged audit records — audit_store → raw. Producer storage IAM; org Analytics entitlement. orkestera_events/lib/orkestera_events/audit/store.ex:62; orkestera_events/lib/orkestera_events/audit/analytics.ex:281; orkestera_events/lib/orkestera_events/audit/analytics.ex:135; orkestera_events/lib/orkestera_events/audit/analytics/copier.ex:349 Read raw batches — raw → analytics. Service storage IAM. analytics/internal/compactor/compactor.go:216 Compact and deduplicate — analytics → curated. Service storage IAM. analytics/internal/compactor/compactor.go:91; analytics/internal/compactor/compactor.go:553 Read curated history — curated → analytics. Verified org; Analytics entitlement. analytics/internal/query/engine.go:83; analytics/internal/query/handler.go:117 Spend query — platform → analytics. aud=analytics; analytics:read; org from verified token. platform/lib/platform/spend/client.ex:35; analytics/internal/query/handler.go:23; analytics/internal/query/handler.go:96 Audit export — core → analytics. aud=analytics; analytics:export; org from verified token. core/lib/core/audit_export.ex:122; analytics/internal/export/handler.go:23; analytics/internal/export/handler.go:90 Org purge — auth → analytics. aud=analytics; analytics:purge; org from verified token. auth/lib/auth/analytics_purge/client.ex:33; analytics/internal/purge/handler.go:18; analytics/internal/purge/handler.go:54 Write audit export and sign download — analytics → exports. Service storage IAM; signed download. analytics/internal/export/export.go:255; analytics/internal/export/export.go:163; analytics/internal/export/export.go:261 Check org Analytics entitlement — analytics → auth. aud=auth; internal:entitlements. analytics/internal/entitlement/entitlement.go:118; analytics/internal/entitlement/entitlement.go:159 Dispatch a governed run — platform → runner. aud=runner; runs:write. platform/lib/platform/runner_client.ex:37; platform/lib/platform/runner_client.ex:18; platform/lib/platform/runner_client.ex:141 Route GraphAgent inference — runner → llmproxy. Proxy credential / run binding. runner/runner/runner.py:440; runner/runner/runner.py:737; runner/runner/runner.py:548 Forward to configured provider — llmproxy → provider. Provider credential; sanitized outbound headers. llmproxy/internal/fallback/fallback.go:1211; llmproxy/internal/fallback/fallback.go:1218; llmproxy/internal/fallback/fallback.go:1228 Device sign-in and token renewal — external_client → auth. OAuth grant-specific authentication. contracts/client/v1/openapi.json:142; contracts/client/v1/openapi.json:225 Read client evidence — external_client → watch. aud=watch; watch:read. contracts/client/v1/openapi.json:1226; contracts/client/v1/openapi.json:1336; contracts/client/v1/openapi.json:1437; contracts/client/v1/openapi.json:1543 Negotiate client session — external_client → core. aud=core; client:session. contracts/client/v1/openapi.json:781 Task read — external_client → platform. aud=platform; tasks:read. contracts/client/v1/openapi.json:1605; contracts/client/v1/openapi.json:1858 Task write — external_client → platform. aud=platform; tasks:write. contracts/client/v1/openapi.json:1605; contracts/client/v1/openapi.json:1858; contracts/client/v1/openapi.json:2050; contracts/client/v1/openapi.json:2169; contracts/client/v1/openapi.json:2282 Send client events / OTLP — external_client → watch. aud=watch; client:ingest. contracts/client/v1/openapi.json:867; contracts/client/v1/openapi.json:956; contracts/client/v1/openapi.json:1091 Provider configuration — platform → core. internal:providers. platform/lib/platform/provider_client.ex:13 Progress event reporting — platform → watch. events:write. platform/lib/platform/event_token.ex:9 External clients — public External clients public Client Edge — public ingress Client Edge public ingress LLMProxy — mesh LLMProxy mesh Inference records — producer-owned Inference records producer-owned Producer audit stores — producer-owned Producer auditstores producer-owned Analytics raw NDJSON — object storage Analytics raw NDJSON object storage Analytics / DuckDB — mesh Analytics / DuckDB mesh Analytics curated Parquet — object storage Analytics curatedParquet object storage Audit export objects — object storage Audit export objects object storage Platform — mesh Platform mesh Core — mesh Core mesh Auth — public identity / mesh Auth public identity / mesh Watch — public client API / mesh Watch public client API / mesh Runner / GraphAgent — mesh Runner / GraphAgent mesh Configured model provider — provider boundary Configured modelprovider provider boundary The complete Orkestera system, portrait view All 15 nodes and 31 source-backed relationships. Moving particles show illustrative direction, not live traffic. Full relationship details follow below. Export client observations: External clients → Client Edge Exchange a telemetry credential: Client Edge → Auth Forward verified client telemetry: Client Edge → Watch Copy terminal task metadata: Watch → Analytics raw NDJSON Read historical task metadata: Watch → Analytics / DuckDB Native inference and tools: External clients → Client Edge Report externally purchased usage: External clients → Client Edge Replace auth and attribute from verified claims: Client Edge → LLMProxy Persist native completion: LLMProxy → Inference records Persist reported usage separately: LLMProxy → Inference records Copy completed inference usage: Inference records → Analytics raw NDJSON Copy acknowledged audit records: Producer audit stores → Analytics raw NDJSON Read raw batches: Analytics raw NDJSON → Analytics / DuckDB Compact and deduplicate: Analytics / DuckDB → Analytics curated Parquet Read curated history: Analytics curated Parquet → Analytics / DuckDB Spend query: Platform → Analytics / DuckDB Audit export: Core → Analytics / DuckDB Org purge: Auth → Analytics / DuckDB Write audit export and sign download: Analytics / DuckDB → Audit export objects Check org Analytics entitlement: Analytics / DuckDB → Auth Dispatch a governed run: Platform → Runner / GraphAgent Route GraphAgent inference: Runner / GraphAgent → LLMProxy Forward to configured provider: LLMProxy → Configured model provider Device sign-in and token renewal: External clients → Auth Read client evidence: External clients → Watch Negotiate client session: External clients → Core Task read: External clients → Platform Task write: External clients → Platform Send client events / OTLP: External clients → Watch Provider configuration: Platform → Core Progress event reporting: Platform → Watch External clients — public External clients Auth — public identity / mesh Auth Client Edge — public ingress Client Edge Core — mesh Core LLMProxy — mesh LLMProxy Model provider — provider boundary Model provider Platform — mesh Platform Runner / GraphAgent — mesh Runner /GraphAgent Watch — public client API / mesh Watch Inference records — producer-owned Inference records Audit records — producer-owned Audit records Raw NDJSON — object storage Raw NDJSON Analytics / DuckDB — mesh Analytics /DuckDB Curated Parquet — object storage Curated Parquet Audit exports — object storage Audit exports

How the platform fits together

Platform dispatches work through Runner and the inference proxy. Core supplies configuration, Watch receives progress, and Analytics serves retained history.

How the platform fits together Platform to Analytics / DuckDB: Spend query; Auth to Analytics / DuckDB: Org purge; Analytics / DuckDB to Auth: Check org Analytics entitlement; Platform to Runner / GraphAgent: Dispatch a governed run; Runner / GraphAgent to LLMProxy: Route GraphAgent inference; LLMProxy to Configured model provider: Forward to configured provider; Platform to Core: Provider configuration; Platform to Watch: Progress event reporting. Full connections follow in the text view. Platform mesh Runner / GraphAgent mesh LLMProxy mesh Configured model provider provider boundary Auth public identity / mesh Core mesh Watch public client API / mesh Analytics / DuckDB mesh Solid: request or storage operation · Dashed: asynchronous copy · Details below
  1. Platform → Runner / GraphAgentDispatch a governed run
  2. Runner / GraphAgent → LLMProxyRoute GraphAgent inference
  3. LLMProxy → Configured model providerForward to configured provider
Explore 8 connections and their source evidence
PlatformAnalytics / DuckDBSpend query
Data
Spend history
Boundary
mesh → mesh
Authorization
aud=analytics; analytics:read; org from verified token
Availability
Implemented wiring; deployment configuration required

Source: platform/lib/platform/spend/client.ex:35 · analytics/internal/query/handler.go:23 · analytics/internal/query/handler.go:96

AuthAnalytics / DuckDBOrg purge
Data
Org copy deletion
Boundary
mesh → mesh
Authorization
aud=analytics; analytics:purge; org from verified token
Availability
Implemented wiring; deployment configuration required

Source: auth/lib/auth/analytics_purge/client.ex:33 · analytics/internal/purge/handler.go:18 · analytics/internal/purge/handler.go:54

Analytics / DuckDBAuthCheck org Analytics entitlement
Data
Org entitlement decision
Boundary
mesh → mesh
Authorization
aud=auth; internal:entitlements
Availability
Implemented wiring; deployment configuration required

Source: analytics/internal/entitlement/entitlement.go:118 · analytics/internal/entitlement/entitlement.go:159

PlatformRunner / GraphAgentDispatch a governed run
Data
Task and workflow run
Boundary
mesh → mesh
Authorization
aud=runner; runs:write
Availability
Implemented wiring; deployment configuration required

Source: platform/lib/platform/runner_client.ex:37 · platform/lib/platform/runner_client.ex:18 · platform/lib/platform/runner_client.ex:141

Runner / GraphAgentLLMProxyRoute GraphAgent inference
Data
GraphAgent model requests
Boundary
run sandbox → mesh
Authorization
Proxy credential / run binding
Availability
Implemented wiring; deployment configuration required

Source: runner/runner/runner.py:440 · runner/runner/runner.py:737 · runner/runner/runner.py:548

LLMProxyConfigured model providerForward to configured provider
Data
Model requests and responses
Boundary
mesh → provider
Authorization
Provider credential; sanitized outbound headers
Availability
Implemented wiring; deployment configuration required

Source: llmproxy/internal/fallback/fallback.go:1211 · llmproxy/internal/fallback/fallback.go:1218 · llmproxy/internal/fallback/fallback.go:1228

PlatformCoreProvider configuration
Data
Scoped service request
Boundary
mesh → mesh
Authorization
internal:providers
Availability
Implemented source; deployment configuration required

Source: platform/lib/platform/provider_client.ex:13

PlatformWatchProgress event reporting
Data
Scoped service request
Boundary
mesh → mesh
Authorization
events:write
Availability
Implemented source; deployment configuration required

Source: platform/lib/platform/event_token.ex:9

Connect a client. Keep its tools.

Client-side tools stay with the client; provider-hosted tools run upstream. Inference, reported usage and client telemetry are distinct paths.

Connect a client. Keep its tools. External clients to Client Edge: Export client observations; External clients to Client Edge: Native inference and tools; External clients to Client Edge: Report externally purchased usage; Client Edge to LLMProxy: Replace auth and attribute from verified claims; LLMProxy to Configured model provider: Forward to configured provider. Full connections follow in the text view. External clients public Client Edge public ingress LLMProxy mesh Configured model provider provider boundary Solid: request or storage operation · Dashed: asynchronous copy · Details below
  1. External clients → Client EdgeExport client observations
  2. External clients → Client EdgeNative inference and tools
  3. External clients → Client EdgeReport externally purchased usage
  4. Client Edge → LLMProxyReplace auth and attribute from verified claims
  5. LLMProxy → Configured model providerForward to configured provider
Explore 15 connections and their source evidence
External clientsClient EdgeExport client observations
Data
OTLP logs / metrics; no inference authority
Boundary
public → verified ingress
Authorization
Telemetry-purpose credential; watch/client:ingest; observed identity
Availability
Implemented wiring; deployment configuration required

Source: client_edge/internal/edge/telemetry.go:67 · client_edge/internal/edge/telemetry.go:85 · client_edge/internal/edge/telemetry.go:98 · client_edge/internal/edge/telemetry.go:104

Client EdgeAuthExchange a telemetry credential
Data
Purpose-bound short-lived Watch token
Boundary
ingress → identity
Authorization
Edge service authentication; immutable purpose and current client grants
Availability
Implemented wiring; deployment configuration required

Source: client_edge/main.go:100 · client_edge/internal/edge/ingest.go:205 · client_edge/internal/edge/ingest.go:213 · auth/lib/auth/ingest_credential.ex:414

Client EdgeWatchForward verified client telemetry
Data
Fixed OTLP upstream; client identity headers discarded
Boundary
ingress → Watch
Authorization
Exchanged client token: aud=watch; client:ingest
Availability
Implemented wiring; deployment configuration required

Source: client_edge/main.go:102 · client_edge/internal/edge/telemetry.go:141 · client_edge/internal/edge/telemetry.go:149 · client_edge/internal/edge/telemetry.go:153

External clientsClient EdgeNative inference and tools
Data
Native requests, tool payloads and streamed responses
Boundary
public → verified ingress
Authorization
aud=client_edge; inference:write; org/client claims
Availability
Implemented wiring; deployment configuration required

Source: client_edge/internal/edge/edge.go:238 · client_edge/internal/edge/edge.go:25 · client_edge/internal/edge/edge.go:26 · infra/cfn/alb.yml:305 · infra/cfn/alb.yml:318 · client_edge/internal/edge/edge.go:163

External clientsClient EdgeReport externally purchased usage
Data
Reported token counts; not an inference request
Boundary
public → verified ingress
Authorization
aud=client_edge; inference:write; org/client claims
Availability
Implemented wiring; deployment configuration required

Source: client_edge/internal/edge/edge.go:238 · client_edge/internal/edge/edge.go:25 · client_edge/internal/edge/edge.go:26 · infra/cfn/alb.yml:305 · infra/cfn/alb.yml:318 · client_edge/internal/edge/edge.go:169 · client_edge/internal/edge/edge.go:170

Client EdgeLLMProxyReplace auth and attribute from verified claims
Data
Native inference / reported usage
Boundary
ingress → mesh
Authorization
aud=llmproxy; internal:inference; client attribution headers rebuilt
Availability
Implemented wiring; deployment configuration required

Source: client_edge/internal/edge/tokens.go:39 · client_edge/internal/edge/tokens.go:40 · client_edge/internal/edge/edge.go:136 · client_edge/internal/edge/edge.go:142 · llmproxy/internal/proxy/edge.go:62

LLMProxyInference recordsPersist native completion
Data
Served completion evidence
Boundary
service → producer store
Authorization
Producer-owned storage
Availability
Implemented wiring; deployment configuration required

Source: llmproxy/internal/proxy/proxy.go:1095

LLMProxyInference recordsPersist reported usage separately
Data
usage_source=reported; debited=false
Boundary
service → producer store
Authorization
Verified client attribution
Availability
Implemented wiring; deployment configuration required

Source: llmproxy/internal/proxy/edge.go:152 · llmproxy/internal/proxy/edge.go:156 · llmproxy/internal/proxy/edge.go:165

LLMProxyConfigured model providerForward to configured provider
Data
Model requests and responses
Boundary
mesh → provider
Authorization
Provider credential; sanitized outbound headers
Availability
Implemented wiring; deployment configuration required

Source: llmproxy/internal/fallback/fallback.go:1211 · llmproxy/internal/fallback/fallback.go:1218 · llmproxy/internal/fallback/fallback.go:1228

External clientsAuthDevice sign-in and token renewal
Data
Published live client contract
Boundary
public client API → service
Authorization
OAuth grant-specific authentication
Availability
Published live contract; deployment configuration required

POST /oauth/token
POST /oauth/device_authorization

Source: contracts/client/v1/openapi.json:142 · contracts/client/v1/openapi.json:225

External clientsWatchRead client evidence
Data
Published live client contract
Boundary
public client API → service
Authorization
aud=watch; watch:read
Availability
Published live contract; deployment configuration required

GET /client/v1/runs
GET /client/v1/runs/{run_id}
GET /client/v1/analysis
GET /api/inference

Source: contracts/client/v1/openapi.json:1226 · contracts/client/v1/openapi.json:1336 · contracts/client/v1/openapi.json:1437 · contracts/client/v1/openapi.json:1543

External clientsCoreNegotiate client session
Data
Published live client contract
Boundary
public client API → service
Authorization
aud=core; client:session
Availability
Published live contract; deployment configuration required

POST /client/v1/sessions

Source: contracts/client/v1/openapi.json:781

External clientsPlatformTask read
Data
Published live client contract
Boundary
public client API → service
Authorization
aud=platform; tasks:read
Availability
Published live contract; deployment configuration required

GET /api/tasks
GET /api/tasks/{task_id}

Source: contracts/client/v1/openapi.json:1605 · contracts/client/v1/openapi.json:1858

External clientsPlatformTask write
Data
Published live client contract
Boundary
public client API → service
Authorization
aud=platform; tasks:write
Availability
Published live contract; deployment configuration required

POST /api/tasks
DELETE /api/tasks/{task_id}
POST /api/tasks/{task_id}/start
POST /api/tasks/{task_id}/halt
POST /api/tasks/{task_id}/resume

Source: contracts/client/v1/openapi.json:1605 · contracts/client/v1/openapi.json:1858 · contracts/client/v1/openapi.json:2050 · contracts/client/v1/openapi.json:2169 · contracts/client/v1/openapi.json:2282

External clientsWatchSend client events / OTLP
Data
Published live client contract
Boundary
public client API → service
Authorization
aud=watch; client:ingest
Availability
Published live contract; deployment configuration required

POST /client/v1/events
POST /client/v1/otlp/v1/logs
POST /client/v1/otlp/v1/metrics

Source: contracts/client/v1/openapi.json:867 · contracts/client/v1/openapi.json:956 · contracts/client/v1/openapi.json:1091

Follow records into Analytics

Producers keep their records. Analytics turns copies into organization-partitioned history for named queries and exports.

Follow records into Analytics Inference records to Analytics raw NDJSON: Copy completed inference usage; Producer audit stores to Analytics raw NDJSON: Copy acknowledged audit records; Analytics raw NDJSON to Analytics / DuckDB: Read raw batches; Analytics / DuckDB to Analytics curated Parquet: Compact and deduplicate; Analytics curated Parquet to Analytics / DuckDB: Read curated history; Platform to Analytics / DuckDB: Spend query; Core to Analytics / DuckDB: Audit export; Analytics / DuckDB to Audit export objects: Write audit export and sign download. Full connections follow in the text view. Inference records producer-owned Analytics raw NDJSON object storage Analytics / DuckDB mesh Analytics curated Parquet object storage Producer audit stores producer-owned Platform mesh Core mesh Audit export objects object storage Solid: request or storage operation · Dashed: asynchronous copy · Details below
  1. Inference records → Analytics raw NDJSONCopy completed inference usage
  2. Analytics raw NDJSON → Analytics / DuckDBRead raw batches
  3. Analytics / DuckDB → Analytics curated ParquetCompact and deduplicate
  4. Analytics curated Parquet → Analytics / DuckDBRead curated history
Explore 12 connections and their source evidence
WatchAnalytics raw NDJSONCopy terminal task metadata
Data
task_trace; bounded metadata, no prompt or tool output
Boundary
producer service → object storage
Authorization
Org Analytics entitlement; configured storage
Availability
Optional asynchronous copy; 30-day curated retention

Source: watch/lib/watch/event_ingestor.ex:59 · watch/lib/watch/task_history.ex:24 · watch/lib/watch/task_history.ex:44 · watch/lib/watch/task_history.ex:59 · watch/lib/watch/task_history.ex:62

WatchAnalytics / DuckDBRead historical task metadata
Data
Latest org/task trace when live events are absent
Boundary
Watch → mesh query
Authorization
aud=analytics; analytics:read; verified org
Availability
Implemented wiring; deployment configuration required

Source: watch/lib/watch/task_history.ex:256 · watch/lib/watch/task_history.ex:258 · analytics/internal/query/catalog.go:241 · watch/lib/watch_web/live/task_timeline_live.ex:46

Inference recordsAnalytics raw NDJSONCopy completed inference usage
Data
inference_usage; orkestera / reported preserved
Boundary
producer store → object storage
Authorization
Producer storage IAM; org Analytics entitlement
Availability
Optional asynchronous copy; entitlement and producer configuration required

Source: llmproxy/internal/proxy/proxy.go:1102 · llmproxy/internal/analytics/row.go:248 · llmproxy/internal/analytics/row.go:122 · llmproxy/internal/analytics/sink.go:382 · llmproxy/internal/analytics/sink.go:410

Producer audit storesAnalytics raw NDJSONCopy acknowledged audit records
Data
audit dataset; producer store remains authoritative
Boundary
producer store → object storage
Authorization
Producer storage IAM; org Analytics entitlement
Availability
Optional asynchronous copy; entitlement and producer configuration required

Source: orkestera_events/lib/orkestera_events/audit/store.ex:62 · orkestera_events/lib/orkestera_events/audit/analytics.ex:281 · orkestera_events/lib/orkestera_events/audit/analytics.ex:135 · orkestera_events/lib/orkestera_events/audit/analytics/copier.ex:349

Analytics raw NDJSONAnalytics / DuckDBRead raw batches
Data
Org / dataset / date partitions
Boundary
object storage → mesh worker
Authorization
Service storage IAM
Availability
Implemented wiring; deployment configuration required

Source: analytics/internal/compactor/compactor.go:216

Analytics / DuckDBAnalytics curated ParquetCompact and deduplicate
Data
Partitioned Parquet
Boundary
mesh worker → object storage
Authorization
Service storage IAM
Availability
Implemented wiring; deployment configuration required

Source: analytics/internal/compactor/compactor.go:91 · analytics/internal/compactor/compactor.go:553

Analytics curated ParquetAnalytics / DuckDBRead curated history
Data
Named queries over org-scoped partitions
Boundary
object storage → mesh query
Authorization
Verified org; Analytics entitlement
Availability
Implemented wiring; deployment configuration required

Source: analytics/internal/query/engine.go:83 · analytics/internal/query/handler.go:117

PlatformAnalytics / DuckDBSpend query
Data
Spend history
Boundary
mesh → mesh
Authorization
aud=analytics; analytics:read; org from verified token
Availability
Implemented wiring; deployment configuration required

Source: platform/lib/platform/spend/client.ex:35 · analytics/internal/query/handler.go:23 · analytics/internal/query/handler.go:96

CoreAnalytics / DuckDBAudit export
Data
Audit export request
Boundary
mesh → mesh
Authorization
aud=analytics; analytics:export; org from verified token
Availability
Implemented wiring; deployment configuration required

Source: core/lib/core/audit_export.ex:122 · analytics/internal/export/handler.go:23 · analytics/internal/export/handler.go:90

AuthAnalytics / DuckDBOrg purge
Data
Org copy deletion
Boundary
mesh → mesh
Authorization
aud=analytics; analytics:purge; org from verified token
Availability
Implemented wiring; deployment configuration required

Source: auth/lib/auth/analytics_purge/client.ex:33 · analytics/internal/purge/handler.go:18 · analytics/internal/purge/handler.go:54

Analytics / DuckDBAudit export objectsWrite audit export and sign download
Data
Audit ZIP: CSV / Parquet and verification material
Boundary
mesh → object storage
Authorization
Service storage IAM; signed download
Availability
Implemented wiring; deployment configuration required

Source: analytics/internal/export/export.go:255 · analytics/internal/export/export.go:163 · analytics/internal/export/export.go:261

Analytics / DuckDBAuthCheck org Analytics entitlement
Data
Org entitlement decision
Boundary
mesh → mesh
Authorization
aud=auth; internal:entitlements
Availability
Implemented wiring; deployment configuration required

Source: analytics/internal/entitlement/entitlement.go:118 · analytics/internal/entitlement/entitlement.go:159

Generated from committed source 2daba84ff582. dev: Analytics configured; int-prod: Analytics configured; staging: Analytics configured. Runtime availability has not been observed by this generator.

Authorization

  • Service credential life300s
  • Authorizationper capability
  • Credential audienceone service
  • Tenant boundarytoken claim
  • Repo access per run1 repo

Evidence

  • Action logappend-only
  • Audit record400d
  • Config audit90d
  • Run artifacts30d
  • Live telemetry24h
  • Secrets in audit rowshash only
  • Operator actionsrecorded to Core

Measurement

  • Scrape intervalconfigurable
  • Quality aggregation5 min
  • Evidence per decisionminimum sample
  • Demotion marginquality policy
  • Model promotionhuman only
  • Run budget ceilingsper-org

Containment

  • Failure modefail-closed
  • Plugin capabilitiesper-org gate
  • Shell commandsarg allow-list
  • Git remote hostsallow-listed
  • Artifact accesswrite xor read
  • Operator stopone control
Checked against the code

We generate these flow views from service wiring, authentication gates, storage rules and target configuration. The checker reports what it can resolve from source and calls out omissions. It does not probe a running deployment or certify every authorization path.

  • Last checked25 Sep 2026 · source + configuration
Our Solution, End to End

From a goal to work you can review.

01

Goal

Describe the work in Ork Chat. Add images when your model supports vision; optional dictation makes an editable draft. The Executive creates a task and breaks it into issues, saved before execution starts.

02

Dispatch

Platform sends the task to Runner with a scoped credential and follows it through execution.

03

Admit

Runner verifies the caller and reads your organization's capability policy. If either check fails, the run is refused. Capacity limits and time limits keep admitted work bounded.

04

Execute

A whole-graph agent runs the node graph in an isolated workspace, checkpointing every node to a durable journal it can resume from. Command and git-remote allow-lists are baked in before it starts. When an iteration ceiling is configured, its allowance spans fan-out, expansion and retries.

05

Observe

Watch and Platform receive progress events. Inference records carry model and usage details. Ork Chat groups task progress beside the conversation, with optional browser read aloud for replies. Delivery is best effort, with dropped events counted.

06

Deliver

Review the saved diff, evaluations and artifacts. When pull-request creation is enabled, successful delivery opens a PR on a separate branch.

What You Can Prove

Follow the work. Know what the evidence can tell you.

When an agent finishes, you need to know what changed and how it got there. When it fails, you need enough context to decide what to do next. Orkestera brings task results, model usage and audit records together, while keeping gaps in telemetry visible.

A useful trail of what happened

Recorded model calls include attribution, model, latency and a bounded prompt/response preview. Configuration audits keep hashes of before and after, and operator actions have their own trail. Use the task results and audit trail to investigate what happened, with secrets kept out of the change record.

  • Inference recordappend-only
  • Config change trailhash only · 90d
  • Node-level run journaldurable
  • Operator action trailrecorded
See which work used the tokens

Recorded usage is grouped by model and task. External inference also carries client and user attribution. Cost estimates depend on the available token counts and rate card; missing prices or incomplete reports stay visible. Model evaluations give you another way to compare routes beyond their advertised price.

  • Cost attributionper task
  • Quality evidenceper evaluated model
  • Route demotionevidence threshold
  • Run budget ceilingsper-org
Pick up after an interruption

The Executive is a supervised, cluster-wide process. Runner launches one GraphAgent process for each run, and the graph writes a durable journal. The saved checkpoints give a restarted run a place to resume and give you a record to inspect.

  • Agent isolationper process
  • Singleton across nodesauto-relocated
  • Interrupted runresumable
Keep working when telemetry falls behind

Evidence is emitted asynchronously under a bounded supervisor: if the observer is slow or down, events are shed and counted rather than queued into the critical path. Agents keep working; the drop is itself a measured signal. Configured health and metrics checks help operators spot missing data. A quiet chart still needs context: it can mean idle work, missing reports or an unavailable source.

  • Event emissionnon-blocking
  • Shed eventscounted
  • Service scrapeconfigured interval
What It Costs

Set limits on the work. Use evidence to choose your models.

Configure iteration and time limits for governed runs. Client Edge applies the organization’s monthly inference budget policy. Usage reported from another provider is shown separately and does not debit that budget. Token-priced estimates do not replace a provider invoice.

Run controls

  • Iterationsengine entrypoint
  • Wall clockhost watchdog
  • Capabilitiespolicy admission
  • Scopeone run
  • Inference budgetorg policy

Attribution

  • Tokens and latencyper call
  • Rolled upper model · per task
  • Cost lands againstthe work
  • Fallback behaviourcaptured

The quality floor

  • Aggregatedevery 5 min
  • Evidence per decisionminimum sample
  • Demotion marginquality policy
  • Retirementautomatic
  • Promotionhuman only

Your models

  • Providers15 in the registry
  • Keyspersonal · org · deployment
  • Endpointsvendor · LAN · on-prem
  • Plain HTTPseparate opt-in
Budgets follow the run

Configured iteration ceilings share one allowance across fan-out, retries and replanning. The host enforces a time limit, while routed inference has its own budget policy. Quality policy can remove an underperforming model from a route after enough evaluated work; promotion remains a human decision.

Look beyond the latest run

What changed this month? What did the work cost?

Watch helps you follow recent activity. When enabled, Analytics retains bounded task metadata for 30 days and a longer history of usage and audits. The original service stores remain the record.

Compare the work behind the spend

In Platform’s Spend page, explore usage by day, user, workflow or role. The Analytics service also supports monthly and model breakdowns. Reported usage from external providers stays separate from inference bought through Orkestera. Missing prices are shown as missing, and priced views use the rate card.

Export an audit you can inspect

Core’s audit export gives authorized administrators records to review and verify. Analytics compacts organization-scoped copies into Parquet and runs named, typed queries with DuckDB. Retention rules and lifecycle checks cover the copies; a purge is an explicit administrative action.

Enable it where you need it

Analytics is implemented and requires the organization’s analytics entitlement. The checked-in development, staging and internal-production configurations enable the service. Your operator can confirm availability and access for your deployment.

Bring the tools your team uses

Connect external clients through Client Edge and keep their local tools. Orkestera attributes routed inference and accepts client telemetry. Observed execution records what the client reports; it does not claim to enforce the client’s local shell or network policy. Read the client API guide →

Scoped access

Sign people in. Scope what clients can do.

Plane A Human · Browser

  • GrantAuthorization Code + PKCE (S256)
  • Tokenopaque · 900s + 30-day refresh
  • VerifyRFC 7662 introspection
  • Scopesrole-scoped session
GET /oauth/authorize → code → access_token → introspect → session  ·  GET /oauth/authorize → code → access_token → introspect → session

Plane B Services & API clients

  • GrantClient Credentials · Device Code
  • Tokenasymmetric JWT · short-lived
  • Verifyoffline against JWKS
  • Scopesgranted per client and audience
client_credentials(aud=core) → JWT → verify(sig,iss,aud,scope,org) → serve  ·  client_credentials(aud=core) → JWT → verify(sig,iss,aud,scope,org) → serve
Interactive clients can use device sign-in and rotating refresh tokens. Services take organization identity from verified token claims. A request body cannot select another tenant.
The Ask

In development, with the people who will run it.

Designed & engineered by
EDOS Engineering
Orkestera is a product of the EDOS Engineering team — turning goals into evaluated, auditable, goal-aligned work.