orc-ai 0.1.34 → 0.1.35

package/README.md

@@ -181,7 +181,9 @@ Or with [docker-compose.yml](docker-compose.yml):
 docker compose up -d
 ```
 
-The container defaults to the `claude` backend (direct Anthropic API via SDK — no host CLI needed). To delegate to an agent running on the host instead, set `ORC_AGENT_LOOP_DEFAULT_BACKEND=agentapi` and run [coder/agentapi](https://github.com/coder/agentapi) on the host:
+The source Docker image includes Node, ACPX, Claude Code and Codex CLI, with versions pinned in the Dockerfile. Its default backend is `claude` through the Anthropic SDK. Tool installation alone does not supply authentication: provide `ANTHROPIC_API_KEY` for Claude, `OPENAI_API_KEY` or a container-local Codex login for `codex-cli`, and the credentials required by whichever agent ACPX launches. Mount your repository and use its **container path** as the project folder. Agent configuration/session files can persist in the Compose `orc-home` volume. Existing ORC policies still apply; native Codex rule interception is not certified by CLI/tool availability. These source changes do not update an already published image.
+
+To delegate to an agent running on the host instead, set `ORC_AGENT_LOOP_DEFAULT_BACKEND=agentapi` and run [coder/agentapi](https://github.com/coder/agentapi) on the host:
 
 ```bash
 agentapi server --allowed-hosts '*' -- \
@@ -449,21 +451,18 @@ The graph itself is deterministic; only the nodes are agents. That means loops,
 
 ```bash
 orc flow list                                    # what graphs are available
-orc flow show orc-plan-build-verify              # nodes, edges, limits
-orc task add "Fix the flaky test" --flow orc-fix-verify
+orc flow show orc-default              # nodes, edges, limits
+orc task add "Fix the flaky test" --flow orc-default --skill orc-bugfix
 orc flow status <taskId>                         # active nodes + the ledger of outcomes
 orc flow resume <taskId> --outcome approved      # resolve a human gate
 orc flow halt <taskId>                           # stop it and kill live nodes
 ```
 
-| Built-in flow           | Shape                                                                        |
-| ----------------------- | ---------------------------------------------------------------------------- |
-| `orc-default`           | build → review → done, looping back while `max_review_rounds` allows         |
-| `orc-review-only`       | A single review pass for a task you moved straight to `review`               |
-| `orc-plan-build-verify` | planner → coder → reviewer, looping until acceptance criteria pass           |
-| `orc-fix-verify`        | bugfix → independent confirmation the fix holds and a regression test exists  |
-| `orc-supervisor`        | Executor keeping its context, plus a supervisor re-verifying from a clean one |
-| `orc-parallel-review`   | Fan out to correctness / security / tests reviewers, join on all three       |
+| Built-in workflow | Use it for |
+| --- | --- |
+| `orc-default` | Development: understand, plan as needed, implement, verify and independently review; bounded rework. `required_review: false` explicitly skips agent review. |
+| `orc-human-review` | The same development process plus human sign-off. Agent review and human approval are always required, even if `required_review` is false. |
+| `orc-review-only` | Review existing work; approve, request changes, or pause when evidence is insufficient. |
 
 **Nodes** are `agent` (runs a session with a skill), `gate` (deterministic branching, fan-out, join points), `human` (waits for you), or `terminal` (ends the run and sets the task's final status). **Edges** carry declarative conditions — `outcome`, `visits`, `var`, `elapsed_secs`, composed with `all`/`any`/`not` — which are data, never evaluated code.
 
@@ -568,6 +567,21 @@ npx skills add niradler/orc --all -g
 
 Skill templates live in `skills/*/SKILL.md` (built-in) and `~/.orc/skills/` (user-defined). Agents discover them via `skill_list` and load with `skill_read`.
 
+On the **Skills** page, each built-in has an **Agent discovery** toggle, plus
+**Hide all built-ins** and **Show all built-ins** controls. Visibility applies
+across the installation and defaults to visible. Hidden built-ins stay on the
+Skills page for management and remain readable by name, including supporting
+files; existing task flows continue to use them. User/imported skills and authored
+global/project instruction overrides remain discoverable.
+
+The policy is saved under `skills.hidden_builtins` in `~/.orc/config.json` and
+read afresh for discovery, including by existing MCP processes. `GET /api/skills`
+omits hidden built-ins; `include_hidden=true` returns the management catalog with
+`discovery_hidden` metadata. `GET /api/skills/settings/visibility` reads the policy and
+`PUT /api/skills/settings/visibility` replaces its `hidden_builtins` array using the usual
+API authentication. This installation-wide preference ignores project config.
+New built-ins default to visible until hidden explicitly.
+
 | Skill              | Type     | Purpose                                                                     |
 | ------------------ | -------- | --------------------------------------------------------------------------- |
 | `orc-worker-base`  | Base     | Default worker behavior - ORC awareness, status updates, deliverable format |