@jterrats/open-orchestra 0.1.0

package/docs/multi-agent-orchestrator-sprint-1.md

@@ -0,0 +1,433 @@
+# Multi-Agent Orchestrator Sprint 1
+
+## Sprint Goal
+
+Deliver a file-based MVP that can initialize a workflow workspace, define roles and tasks, record append-only events, enforce basic readiness gates, create structured handoffs, and show status. This sprint proves collaboration through artifacts before adding real LLM provider execution.
+
+## Sprint Assumptions
+
+- The first implementation is local-first and file-based.
+- No real LLM provider integration is required in Sprint 1.
+- The CLI is the primary interface.
+- TypeScript/Node is the primary runtime for the CLI, schemas, workflow engine, and Playwright integration.
+- Python is allowed as an auxiliary worker runtime for tasks where it is clearly stronger, such as data processing, ML/AI utilities, report generation, or integrations with Python-first tooling.
+- The orchestrator must be provider-agnostic from the data model, even if providers are not implemented yet.
+- The MVP should work inside any git repository without requiring external services.
+
+## Stack Decision
+
+- **Primary language**: TypeScript.
+- **Runtime**: Node.js.
+- **CLI**: Node-based `orchestra`.
+- **Schema validation**: TypeScript-first schema library.
+- **Automated browser testing**: Playwright.
+- **Unit tests**: TypeScript test runner selected during implementation.
+- **Auxiliary runtime**: Python workers invoked only through explicit command contracts.
+
+Rationale:
+- Web and Playwright are first-class priorities, so TypeScript keeps CLI, browser automation, schemas, and future UI work in one ecosystem.
+- Python remains available for specialized workers without making the orchestrator depend on Python for its core control plane.
+- Provider and tool integrations must stay behind interfaces so the runtime choice does not leak into workflow artifacts.
+
+## In Scope
+
+- `.agent-workflow/` structure.
+- Configurable roles.
+- Task graph persistence.
+- Append-only event log.
+- Basic status command.
+- Basic handoff generation and validation.
+- Basic review recording.
+- Basic evidence registration.
+- Definition of Ready gate.
+- Provider configuration schema stub.
+- Version-controlled pre-commit hook contract for static analysis.
+
+## Out of Scope
+
+- Real LLM API calls.
+- Automatic code editing.
+- Parallel process execution.
+- Playwright test generation.
+- Python worker implementation.
+- Web UI.
+- Cloud storage.
+- Multi-user authentication.
+
+## Sprint Backlog
+
+### Story CLI-001: Initialize Workflow
+Priority: P0
+
+As a user, I want `orchestra init` to create workflow files so that a repo can opt into orchestrated agent work.
+
+Acceptance criteria:
+- Creates `.agent-workflow/`.
+- Creates `tasks.json`, `roles.json`, `locks.json`, `events.jsonl`, and `config.json`.
+- Creates `decisions/`, `handoffs/`, `evidence/`, and `reviews/`.
+- Does not overwrite existing workflow files unless `--force` is passed.
+- Prints next steps after initialization.
+
+Developer tasks:
+- Define default workspace layout.
+- Implement init command.
+- Add schema validation for generated files.
+- Add unit tests for normal init, existing files, and force mode.
+
+QA notes:
+- Verify init in empty repo.
+- Verify init in repo with existing `.agent-workflow/`.
+- Verify generated JSON is valid.
+
+Evidence required:
+- Unit test command and result.
+- Sample generated tree.
+
+### Story ROLE-001: Define Role Catalog
+Priority: P0
+
+As an administrator, I want default roles generated during init so that tasks can be assigned to explicit responsibilities.
+
+Acceptance criteria:
+- `roles.json` includes core roles: parent, product_owner, architect, developer, qa, security, devops, sre, dba, ux_ui_designer, release_manager, compliance_privacy, technical_writer.
+- Each role includes name, description, capabilities, required handoff fields, and blocking authority.
+- Role schema rejects missing role ID, description, or capabilities.
+
+Developer tasks:
+- Define role schema.
+- Add default roles.
+- Add validation tests.
+
+QA notes:
+- Verify all default roles are created.
+- Verify invalid roles fail validation.
+
+Evidence required:
+- Unit test command and result.
+- `roles.json` sample.
+
+### Story TASK-001: Persist Task State
+Priority: P0
+
+As a parent agent, I want task state persisted to disk so that workflow status survives process restarts.
+
+Acceptance criteria:
+- `tasks.json` stores task ID, title, owner role, status, dependencies, inputs, outputs, gates, and timestamps.
+- Supports statuses: pending, ready, in_progress, blocked, review, approved, rejected, done, canceled.
+- Rejects dependencies that point to unknown task IDs.
+- Rejects tasks assigned to unknown roles.
+
+Developer tasks:
+- Define task schema.
+- Implement task read/write helpers.
+- Add validation for dependencies and role references.
+- Add unit tests.
+
+QA notes:
+- Verify valid task file passes.
+- Verify unknown dependency fails.
+- Verify unknown owner role fails.
+
+Evidence required:
+- Unit test command and result.
+- Example task graph.
+
+### Story MEM-001: Append Workflow Events
+Priority: P0
+
+As a system, I want all workflow events stored in an append-only log so that collaboration is auditable.
+
+Acceptance criteria:
+- Appends JSON lines to `events.jsonl`.
+- Event includes ID, type, task ID, actor role, timestamp, summary, artifact links, and metadata.
+- Supports event types: WORKFLOW_INITIALIZED, TASK_ASSIGNED, HANDOFF_READY, REVIEW_RECORDED, EVIDENCE_ADDED, GATE_BLOCKED, GATE_PASSED.
+- Does not rewrite existing events.
+
+Developer tasks:
+- Define event schema.
+- Implement append helper.
+- Add event ID generation.
+- Add unit tests for append-only behavior.
+
+QA notes:
+- Verify multiple events append in order.
+- Verify invalid event is rejected.
+
+Evidence required:
+- Unit test command and result.
+- Example `events.jsonl`.
+
+### Story CLI-002: Show Status
+Priority: P0
+
+As a user, I want `orchestra status` to show workflow progress so that I can inspect current state quickly.
+
+Acceptance criteria:
+- Shows task counts by status.
+- Shows blocked tasks and reasons.
+- Shows pending reviews and missing evidence.
+- Shows active locks.
+- Supports `--json`.
+
+Developer tasks:
+- Implement status reader.
+- Add human-readable formatter.
+- Add JSON output.
+- Add unit tests for empty, normal, and blocked states.
+
+QA notes:
+- Verify status before and after sample tasks.
+- Verify JSON output is parseable.
+
+Evidence required:
+- Unit test command and result.
+- Example status output.
+
+### Story GATE-001: Enforce Definition of Ready
+Priority: P0
+
+As a parent agent, I want readiness validated before implementation so that work does not start with hidden ambiguity.
+
+Acceptance criteria:
+- Validates backlog item, goal, scope, acceptance criteria, assumptions, risks, selected roles, and test strategy.
+- Produces a readiness report.
+- Blocks tasks from moving to `ready` when required fields are missing.
+- Allows mechanical-task override with rationale.
+
+Developer tasks:
+- Define readiness schema.
+- Implement readiness validator.
+- Add transition guard for pending to ready.
+- Add unit tests.
+
+QA notes:
+- Verify complete task passes readiness.
+- Verify missing acceptance criteria blocks readiness.
+- Verify mechanical override records rationale.
+
+Evidence required:
+- Unit test command and result.
+- Example readiness report.
+
+### Story HAND-001: Generate Developer-to-QA Handoff
+Priority: P1
+
+As a Developer, I want a structured handoff to QA so that QA can test with full context.
+
+Acceptance criteria:
+- Generates handoff markdown under `handoffs/`.
+- Includes task ID, changed components, behavior changed, unit tests, commands run, known gaps, risks, and recommended Playwright coverage.
+- Validates required fields before recording HANDOFF_READY event.
+
+Developer tasks:
+- Create handoff template.
+- Implement `orchestra handoff`.
+- Validate required fields.
+- Add unit tests.
+
+QA notes:
+- Verify handoff generated from valid input.
+- Verify missing test evidence blocks handoff.
+
+Evidence required:
+- Unit test command and result.
+- Example handoff markdown.
+
+### Story CLI-004: Record Review
+Priority: P1
+
+As a reviewer, I want `orchestra review` to approve, block, or request changes so that gate status is auditable.
+
+Acceptance criteria:
+- Writes review markdown under `reviews/`.
+- Captures reviewer role, result, severity, findings, recommendation, and artifact links.
+- Appends REVIEW_RECORDED event.
+- Blocks invalid reviewer role.
+
+Developer tasks:
+- Create review template.
+- Implement review command.
+- Add validation.
+- Add unit tests.
+
+QA notes:
+- Verify approve, block, and request changes.
+- Verify unknown reviewer role fails.
+
+Evidence required:
+- Unit test command and result.
+- Example review artifact.
+
+### Story CLI-005: Add Evidence
+Priority: P1
+
+As an agent, I want `orchestra evidence add` to register evidence artifacts so that tests and reviews are traceable.
+
+Acceptance criteria:
+- Supports evidence types: command, file, screenshot, trace, video, log, report.
+- Links evidence to task and role.
+- Appends EVIDENCE_ADDED event.
+- Validates referenced file paths when evidence points to a file.
+
+Developer tasks:
+- Define evidence schema.
+- Implement evidence command.
+- Add validation and tests.
+
+QA notes:
+- Verify command evidence.
+- Verify file evidence with existing path.
+- Verify missing file fails validation.
+
+Evidence required:
+- Unit test command and result.
+- Example evidence artifact.
+
+### Story MODEL-002: Configure Models by Role
+Priority: P2
+
+As an administrator, I want provider and model preferences in config so that multi-model routing can be added without schema redesign.
+
+Acceptance criteria:
+- `config.json` supports provider defaults and per-role model settings.
+- Settings include provider, model, fallbacks, max tokens, max cost, timeout, retries, and required capabilities.
+- No real provider call is implemented.
+
+Developer tasks:
+- Define provider config schema.
+- Add default config stub.
+- Add validation tests.
+
+QA notes:
+- Verify valid multi-provider config passes.
+- Verify unknown provider reference fails if used by a role.
+
+Evidence required:
+- Unit test command and result.
+- Example provider config.
+
+### Story CFG-004: Define Tool Runtime Contracts
+Priority: P1
+
+As a developer, I want tool runtime contracts for Node, Playwright, and optional Python workers so that future agents can invoke tools consistently.
+
+Acceptance criteria:
+- `config.json` can declare tool runtimes for node, playwright, and python.
+- Tool entries include command, args, working directory, allowed roles, timeout, evidence behavior, and risk level.
+- Python tools are disabled by default unless explicitly configured.
+- Runtime config is validated without executing tools.
+
+Developer tasks:
+- Add tool runtime schema.
+- Add default Node and Playwright tool entries.
+- Add optional Python worker config example.
+- Add validation tests.
+
+QA notes:
+- Verify default tool config passes validation.
+- Verify invalid runtime command fails validation.
+- Verify Python runtime remains opt-in.
+
+Evidence required:
+- Unit test command and result.
+- Example tool runtime config.
+
+### Story CFG-005: Enforce Static Analysis Git Hooks
+Priority: P0
+
+As a maintainer, I want a version-controlled pre-commit hook contract so that static analysis runs before any commit.
+
+Acceptance criteria:
+- Defines required pre-commit checks for TypeScript/Node: format check, lint, typecheck, secret scan, and staged-file validation.
+- Defines optional Python checks when Python workers exist: Ruff, typecheck, Bandit, and dependency audit.
+- Pre-commit hook fails closed and blocks commit when checks fail.
+- `--no-verify` bypass requires explicit user approval and a recorded follow-up item.
+- CI requirements include the same checks plus deeper SAST, dependency scan, Playwright, container, and IaC checks when applicable.
+
+Developer tasks:
+- Add static analysis hook requirements to config schema.
+- Add default hook command definitions for Node/TypeScript.
+- Add optional Python hook command examples.
+- Add validation tests for required hook entries.
+
+QA notes:
+- Verify default hook config includes required checks.
+- Verify missing lint or typecheck entry fails validation.
+- Verify Python checks are only required when Python workers are enabled.
+
+Evidence required:
+- Unit test command and result.
+- Example pre-commit hook config.
+
+## Sprint 1 Definition of Ready
+
+- Product goal and MVP scope are documented.
+- Stories have acceptance criteria.
+- Out-of-scope work is explicit.
+- File-based architecture is accepted for MVP.
+- No external provider dependency is required.
+
+## Sprint 1 Definition of Done
+
+- CLI can initialize workflow state.
+- Roles, tasks, events, handoffs, reviews, and evidence have schemas.
+- Status command reports current workflow health.
+- Readiness gate blocks incomplete work.
+- Tool runtime contracts exist for Node, Playwright, and optional Python workers.
+- Static analysis pre-commit hook contract exists and is validated.
+- Unit tests cover core schema validation and CLI behavior.
+- Documentation includes setup, commands, examples, and known limitations.
+
+## Proposed Technical Architecture
+
+```text
+orchestra
+  commands/
+    init
+    status
+    handoff
+    review
+    evidence
+  core/
+    workspace
+    schemas
+    events
+    tasks
+    roles
+    gates
+    artifacts
+    tools
+  tools/
+    playwright
+    python
+  .agent-workflow/
+    config.json
+    roles.json
+    tasks.json
+    locks.json
+    events.jsonl
+    decisions/
+    handoffs/
+    evidence/
+    reviews/
+```
+
+## Sprint Risks
+
+- Scope creep into real LLM orchestration before file workflow is proven.
+- Too much process overhead for small tasks.
+- Schema too rigid for different repos.
+- Evidence capture can become noisy if summaries are not concise.
+- Hybrid runtime can add complexity if Python workers are allowed without strict contracts.
+
+## Recommended First Implementation Order
+
+1. Workspace layout and init command.
+2. Schemas for roles, tasks, events, and config.
+3. Event append helper.
+4. Status command.
+5. Readiness gate.
+6. Tool runtime contract schema.
+7. Static analysis pre-commit hook contract.
+8. Handoff, review, and evidence commands.
+9. Documentation and examples.

package/docs/orchestra-mvp.md

@@ -0,0 +1,176 @@
+# Open Orchestra MVP
+
+Open Orchestra is a local-first, provider-agnostic framework for governed multi-agent software delivery. The public CLI is `orchestra`.
+
+It stores workflow state in `.agent-workflow/` and coordinates agents through files, events, handoffs, reviews, evidence, gates, locks, and model provenance.
+
+## Compatibility
+
+- `orchestra` is the only public CLI name.
+- Existing `.agent-workflow/` data remains valid.
+- Existing `AGENTS.md`, `CLAUDE.md`, Cursor rules, and generated instruction files remain supported entry points.
+- `ORCHESTRA.md` is the intended future primary guide name; it is not required for existing projects.
+
+## Commands
+
+```bash
+npm install
+npm run build
+npm run lint
+npm run typecheck
+npm run secret-scan
+npm test
+npm run hooks:install
+node bin/orchestra.js init
+node bin/orchestra.js status
+node bin/orchestra.js status --json
+node bin/orchestra.js validate
+node bin/orchestra.js validate --json
+node bin/orchestra.js task add --id TASK-1 --title "First task" --owner developer --paths src/commands.ts
+node bin/orchestra.js task list
+node bin/orchestra.js task update --id TASK-1 --status in_progress
+node bin/orchestra.js task deps --id TASK-1
+node bin/orchestra.js graph plan
+node bin/orchestra.js graph plan --json
+node bin/orchestra.js graph run-next
+node bin/orchestra.js graph run-next --json
+node bin/orchestra.js graph run-ready
+node bin/orchestra.js graph run-ready --json
+node bin/orchestra.js lock claim --task TASK-1 --role developer --path src/commands.ts --reason "editing commands"
+node bin/orchestra.js lock list
+node bin/orchestra.js lock release --id lock-123
+node bin/orchestra.js roles list
+node bin/orchestra.js roles list --json
+node bin/orchestra.js readiness --task TASK-1
+node bin/orchestra.js gate --gate architecture --task TASK-1
+node bin/orchestra.js gate --gate qa-release --task TASK-1
+node bin/orchestra.js gate --gate risk-review --task TASK-1
+node bin/orchestra.js gate --gate release-readiness --task TASK-1
+node bin/orchestra.js review list
+node bin/orchestra.js decision add --task TASK-1 --owner architect --title "Use service layer" --context "CLI should stay thin" --decision "Move behavior to services" --consequences "Reusable core"
+node bin/orchestra.js decision list --task TASK-1
+node bin/orchestra.js evidence list
+node bin/orchestra.js usage --task TASK-1
+node bin/orchestra.js usage --task TASK-1 --json
+node bin/orchestra.js budget check --task TASK-1
+node bin/orchestra.js budget check --task TASK-1 --json
+node bin/orchestra.js config show
+node bin/orchestra.js config show --json
+node bin/orchestra.js approvals list --task TASK-1
+node bin/orchestra.js approvals show --id TASK-1-budget-fallback
+node bin/orchestra.js approvals approve --id TASK-1-budget-fallback --approver "user" --rationale "approved cheaper fallback"
+node bin/orchestra.js approvals reject --id TASK-1-budget-fallback --approver "user" --rationale "not approved"
+node bin/orchestra.js summary
+node bin/orchestra.js summary --json
+node bin/orchestra.js pr-summary --task TASK-1
+node bin/orchestra.js pr-summary --task TASK-1 --json
+node bin/orchestra.js context --task TASK-1
+node bin/orchestra.js context --task TASK-1 --json
+node bin/orchestra.js plan --task TASK-1
+node bin/orchestra.js plan --task TASK-1 --json
+node bin/orchestra.js run --task TASK-1
+node bin/orchestra.js run --task TASK-1 --json
+node bin/orchestra.js run --task TASK-1 --approve-budget-fallback --approver "user" --rationale "approved cheaper fallback"
+node bin/orchestra.js run --task TASK-1 --json # consumes stored approved budget fallback when present
+node bin/orchestra.js playwright plan --task TASK-1
+node bin/orchestra.js playwright plan --task TASK-1 --json
+node bin/orchestra.js playwright evidence --task TASK-1 --kind trace --path trace.zip --summary "trace captured"
+node bin/orchestra.js model providers
+node bin/orchestra.js model providers --json
+node bin/orchestra.js model set-role --role developer --provider openai --model gpt-example
+node bin/orchestra.js model complete-fake --provider primary --model fake-model --prompt "hello" --fallbacks backup --fail-provider primary
+node bin/orchestra.js model provenance add --task TASK-1 --role developer --provider openai --model gpt-example --prompt-id prompt-1 --response-id response-1 --finish-reason stop
+node bin/orchestra.js model provenance list --task TASK-1 --json
+```
+
+## Workflow Files
+
+```text
+.agent-workflow/
+  config.json
+  roles.json
+  tasks.json
+  locks.json
+  events.jsonl
+  approvals/
+  decisions/
+  handoffs/
+  evidence/
+  reviews/
+  runs/
+```
+
+
+## Stable JSON Contracts
+
+The VS Code Control Center should consume stable JSON outputs instead of parsing human-readable text or duplicating file reads. Current UI-facing commands include:
+
+- `orchestra status --json`
+- `orchestra validate --json`
+- `orchestra graph plan --json`
+- `orchestra summary --json`
+- `orchestra context --task <id> --json`
+- `orchestra approvals list --json`
+- `orchestra evidence list --json`
+- `orchestra roles list --json`
+- `orchestra config show --json`
+
+The role catalog JSON includes capabilities, required handoff fields, blocking authority, activation criteria, expected evidence, and gate participation.
+
+## Role Activation
+
+Open Orchestra initializes a broad role catalog but does not require every role to participate in every task. The parent/orchestrator should activate roles based on task type, risk, touched paths, impact areas, and gate requirements.
+
+Default roles include delivery roles such as Product Manager, Product Owner, Business Analyst, Architect, Developer, QA, Security, DevOps, SRE, DBA, UX/UI Designer, Release Manager, Compliance/Privacy, and Technical Writer. They also include orchestration roles for modern multi-agent systems: Planner, Reviewer/Critic, Toolsmith, Context Curator, Policy/Governance, Observability/Incident Response, Data/Privacy Officer, Domain Expert, UX Researcher/Accessibility Reviewer, Performance Engineer, and Game Designer.
+
+Each default role declares:
+
+- activation criteria for when the role should be used;
+- expected evidence that should be produced or reviewed;
+- gate participation for readiness, architecture, QA, risk, or release decisions.
+
+This keeps collaboration explicit even when the underlying LLM provider does not support native subagent-to-subagent communication.
+
+## VS Code Control Center
+
+The VS Code Control Center scaffold is under `extensions/vscode-open-orchestra`. It follows the same boundary as the CLI: extension UI calls stable JSON commands and renders results, while workflow state remains in Open Orchestra services and files. The first supported commands are status, validate, graph plan, summary, roles, approvals, evidence, config inspection, and Playwright evidence attachment.
+
+## Reusable Core
+
+- `src/types.ts` owns workflow domain contracts shared by CLI and future adapters.
+- `src/workflow-services.ts` owns reusable workflow behavior for tasks, locks, readiness, handoffs, reviews, evidence, status, and summary.
+- `orchestra task deps` checks whether task dependencies are approved or done before downstream work starts.
+- `orchestra graph plan` classifies current tasks as dependency-ready, blocked, or complete before execution.
+- `orchestra graph run-next` executes the first dependency-ready task through the existing run flow.
+- `orchestra graph run-ready` executes the current dependency-ready task snapshot sequentially through the existing run flow.
+- Graph scheduling omits tasks with active task locks or path conflicts and reports them as locked.
+- Graph batch runs write summary artifacts under `.agent-workflow/runs/batches/`.
+- `orchestra decision` records ADR-like decision artifacts and append-only events for task context.
+- `orchestra context` aggregates task state, dependencies, locks, decisions, handoffs, reviews, evidence, gates, model provenance, and risks before an agent starts work.
+- `orchestra plan` generates an ordered parent-agent execution plan by role without invoking model providers.
+- `orchestra run` checks task dependencies and usage budgets before execution, then can execute an approved budget fallback with the deterministic fake provider, recording step events and model provenance without network calls.
+- Budget fallback requests write reviewable approval proposals under `.agent-workflow/approvals/`.
+- Stored approved budget fallback proposals can be consumed by a later `orchestra run` without repeating approval flags.
+- Run steps write artifacts under `.agent-workflow/runs/<task>/` so downstream agents can consume prior role output.
+- `orchestra pr-summary` generates PR or release-review context from task state, evidence, reviews, gates, handoffs, locks, rollout notes, and rollback notes.
+- `orchestra playwright plan` generates deterministic Playwright test plans from task acceptance criteria and QA context.
+- `orchestra playwright evidence` attaches Playwright screenshots, traces, videos, or reports through the existing evidence workflow.
+- `orchestra usage` aggregates request counts, token totals, and estimated model cost from recorded model provenance events.
+- `orchestra budget check` enforces configured usage budgets from local provenance events and fails when limits are exceeded.
+- `orchestra approvals` lists, shows, approves, and rejects approval proposal artifacts through append-only decision events.
+- `src/workflow-gates.ts` owns reusable gate evaluators. Current gates include `architecture`, which blocks non-trivial work until proposal, user approval, and architect approval are present; `qa-release`, which requires QA plan, execution status, evidence, and no unresolved critical QA block; `risk-review`, which maps impact areas to required risk-owner reviews; and `release-readiness`, which composes readiness, architecture, QA, risk, evidence, handoff, review, and lock checks.
+- `src/model-providers.ts` owns provider-agnostic model contracts, an in-memory provider registry, and a fake provider for deterministic tests.
+- `orchestra model providers` lists configured provider routing without invoking real model APIs.
+- `orchestra model set-role` configures provider/model routing per role without invoking real model APIs.
+- `orchestra model complete-fake` simulates provider fallback behavior without invoking real model APIs.
+- `orchestra model provenance` records model usage metadata in the append-only event log without storing raw prompts, raw responses, or secrets.
+- `src/commands.ts` is the CLI adapter: it parses command options, delegates to services, and renders terminal output.
+- Services accept an explicit repo root, so future web, GitHub Actions, Playwright, or multi-model orchestration layers can reuse the same core without depending on `process.cwd()`.
+
+## Current Scope
+
+- No real LLM calls.
+- No automatic code editing.
+- No Playwright generation yet.
+- Python workers are represented in config only and disabled by default.
+- Static analysis is enforced locally through `.githooks/pre-commit` after running `npm run hooks:install`.

package/package.json

@@ -0,0 +1,63 @@
+{
+  "name": "@jterrats/open-orchestra",
+  "version": "0.1.0",
+  "type": "module",
+  "bin": {
+    "orchestra": "bin/orchestra.js"
+  },
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "test": "npm run build && node --test test/**/*.js extensions/**/*.test.cjs",
+    "lint": "eslint . && prettier --check \"{bin,scripts,test}/**/*.js\" \"extensions/**/*.{cjs,json,md}\" \"src/**/*.ts\" \"*.json\"",
+    "format": "prettier --write \"{bin,scripts,test}/**/*.js\" \"extensions/**/*.{cjs,json,md}\" \"src/**/*.ts\" \"*.json\"",
+    "secret-scan": "node scripts/secret-scan.js",
+    "validate:workflow": "sh -c 'test ! -d .agent-workflow || (npm run build && node bin/orchestra.js validate)'",
+    "precommit": "npm run lint && npm run typecheck && npm run secret-scan && npm test && npm run validate:workflow",
+    "hooks:install": "git config core.hooksPath .githooks"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^25.6.0",
+    "eslint": "^10.2.1",
+    "prettier": "^3.8.3",
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.59.0"
+  },
+  "dependencies": {
+    "chart.js": "^4.5.1"
+  },
+  "description": "Local control plane for AI-assisted development orchestration, evidence gates, and agent workflows.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jterrats/open-orchestra.git"
+  },
+  "homepage": "https://open-orchestra.jterrats.dev",
+  "bugs": {
+    "url": "https://github.com/jterrats/open-orchestra/issues"
+  },
+  "license": "MIT",
+  "files": [
+    "bin/",
+    "dist/",
+    "rules/",
+    "docs/",
+    "AGENTS.md",
+    "CLAUDE.md",
+    "README.md",
+    "package.json"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "ai-agents",
+    "agent-orchestration",
+    "workflow-gates",
+    "playwright",
+    "developer-tools"
+  ]
+}