The fusion
no one else ships.
Conformance for a plain VPS. A secret-to-consumer graph. Governed autonomy enforced in code. An install that proves itself. Four things a solo or small operator needs together, that no single existing tool ships as one instrument.
pip install orrery && orrery doctor
The empty fusion.
Conformance tools assume a cluster someone else already manages. Secrets managers assume you already run one. Agent-governance products assume a platform team. Orrery starts from a plain box a solo operator can actually run, and fills the seam between those categories.
A plain VPS, not a cluster
The reconciler runs read-only over plain ssh into any Linux box: a Hetzner VPS, a DigitalOcean droplet, a Raspberry Pi. No control plane assumed on the far end.
A secret graph, value-blind
Every secret mapped to the consumers that reference it, confirmed without ever reading a value. That graph is what makes rotation safe later, and it is not something Infisical or Doppler ships.
Governed autonomy, in code
Standing rules for an AI operator are only real if they live below the model. The checks refuse unsafe input structurally, they do not ask a model to behave.
An install that proves itself
orrery doctor verifies the installation actually stands, then the reconciler keeps watching afterward, so nothing is trusted blind a month later.
Six checks, and they are the whole spine.
The reconciler holds each fact as a declaration plus a probe, and runs the probe continuously: a thing is not "declared", it is declared and its probe passes. Findings carry a severity from OK through INFO and WARN up to DRIFT, the core signal, disagreement between declared and observed, and FAIL, a broken invariant. All six ship today, read-only: they measure and report, they never change a box.
One source of truth
A bucket-to-account table is copied, in three different encodings, into the tools that consume it: a Python dict, a bash associative array, a bash case function. This check reads the truth and each consumer's own live encoding and reports exactly where they disagree.
OperationalThe reach matrix, live
The profile declares which edges from this box should be open and which should stay closed. Actual ssh reach is probed both ways: a depended-on link that is down is a failure; a deliberately closed link that has reopened is drift.
OperationalThe secret graph
Every declared secret is checked by its identity, a vault path or an env var name, never its value, against a fail-closed allowlist before anything is scanned. Confirmed edges pass; a consumer that stopped referencing a secret is drift.
OperationalWhat must exist, does
Required members are confirmed present; a missing one fails the run. A path marked planned-absent, a hardening step not yet taken, stays informational while absent and only warns if it reappears.
OperationalNothing quietly shrinks
A count, files in a directory or lines in a file, is held between a declared floor and ceiling. Dropping below the floor is a real incident; climbing far above it flags the floor itself as stale and due for recalibration.
OperationalThe guard cannot be moved
Every enforcement file must stay root-owned and no more writable than declared, so the rules that gate an AI operator's actions cannot be quietly loosened from inside. A file marked planned reports informational until it lands.
OperationalThree tenets, made concrete.
A principle is cheap until it shows up as code. Here is where each one actually lives.
It verifies its own install.
orrery doctor is the self-check. The build sequence puts a blank-box install ahead of every later feature, because the install target is the real test, not a description of one.
Enforced in code, not asked of a model.
fleet-reach refuses to probe a host string that does not look like a safe ssh alias. secret-edges refuses to scan or echo anything that fails its identity allowlist first. The guard is structural, never a prompt asking something to behave.
Measure, do not read.
org-map does not trust that consumers agree with a table, it parses each one's actual live encoding and reports where they diverge. Documentation is the thing under test, including the status below, about Orrery itself.
How it is actually built.
Measure, do not read applies to Orrery's own claims too. What follows is stated as plainly as a drift finding: what runs today, what is in progress, and what is not built yet. Honest status is not a caveat here, it is the point.
Declared vs observed
Six read-only checks; a fact is declared and its probe passes, continuously.
Curated memory, under git
Replicated and restore-verified, not a folder of notes hoping to stay in sync.
Admission control, below the model
Rules gate tool calls and operator actions in code and architecture, never asked of a model.
The terminal instrument
A themed operator deck plus a strong CLI over the same engine.
Verifies its own install
orrery doctor confirms the installation actually stands, cold, on a blank box.
Per-directory isolation
Context resolves per working directory, so one installation cannot bleed into another's identity.
Box enrollment
One command to enrol a box with a role; the reach matrix becomes generated, not hand-kept.
Continuous fleet watch
Report-only reconciliation across the whole fleet, running on its own schedule instead of on demand.
Linked secret rotation
Does not exist. It would wrap OpenBao (MPL-2.0) and walk the secret-edges graph to rotate a credential everywhere it is consumed. The graph is real and running today; the fan-out apply and rollback across consumers is not, and will not ship until breakglass recovery is proven first.
Hosted control plane
Does not exist yet. The governed-autonomy trust layer and approvals, run for you rather than self-hosted.
Graphical fleet view
Does not exist yet. Today's operator surface is the CLI and the terminal deck; a screen-based fleet view is a later, separate scope.
Open at the core.
The core holds your secrets and reaches every box, so it is open and auditable: security is not a black box here. The layer that scales and governs is where the business lives.
ESS Orrery
Free to run, study, and modify. Zero runtime dependencies, read-only, identity-free: the reconciler and its six checks, per-directory context isolation, a self-verifying install, the CLI, and the themed terminal deck.
Governed autonomy
The trust layer for handing off consequential work safely: enforced standing rules, durable memory, plan-then-approve, a hosted control plane, and the graphical fleet view. Not part of this repository.
A commercial license is available from Evening Star Productions for anyone who cannot meet the AGPL terms (offering a modified version to others over a network under the same license). Full model and licensing detail on the pricing page.