An instrument this honest about its own reach.
Orrery is asked to reach every box in a fleet and sit near every secret it has. That is exactly the kind of software that should not be trusted on reputation. Here is what it actually does, stated as plainly as a drift finding, and what it does not do yet.
Six properties, each one load-bearing.
None of these are marketing claims layered on afterward. Each one is a property of the architecture, checkable by reading the source, because the source is the whole product.
Read-only by construction
The reconciler measures and reports; it never changes a box. The Box abstraction every check runs against exposes exactly four methods, and none of them writes.
Structural, not a policyValue-blind secret graph
secret-edges maps each secret to its consumers by a non-secret identity, a vault path or an env var name, and is fail-closed: anything that is not a constrained identity shape is refused, never scanned, never echoed.
OperationalNo phone-home
The core is identity-free and runs entirely on the operator's own boxes. It has zero runtime dependencies and makes no outbound network call of its own; the only network traffic it initiates is the ssh read a profile explicitly declares.
Structural, not a policyAuditable in full
The core is AGPL-3.0-or-later, source-available and copyleft, with zero runtime dependencies. Software with this much reach should be readable end to end, not taken on faith.
AGPL-3.0-or-laterEnforced in code, not asked of a model
Rules live below the model, in the guard and the architecture. fleet-reach refuses a host string that is not a safe ssh alias; secret-edges refuses anything outside its identity allowlist, before either one runs. A safety you must remember to honor is not a safety.
Structural, not a policySelf-verifying install
orrery doctor confirms an installation actually stands, cold, on a blank box. The reconciler then keeps watching for drift afterward, so nothing here is trusted blind a month later.
OperationalThe whole read surface, in four methods.
Every check the reconciler runs, against a local box or a remote one over ssh, is written against one interface. This is the entire contact surface with a measured box: no method on it can write. On a remote box each read is a bounded, timed-out, BatchMode ssh command, and every path is shell-quoted so a profile value cannot become a remote flag or reach the remote shell.
# orrery/reconciler/box.py, the target a reconciler measures
class Box(Protocol):
def exists(self, path: str) -> bool: ...
def read_text(self, path: str) -> str | None:
"""Return file contents, or None if absent or unreadable. Never raises."""
def list_files(self, root: str, max_files: int) -> list[str] | None:
"""Return up to max_files file paths under root, or None if unlistable."""
def file_meta(self, path: str) -> tuple[int, int] | None:
"""Return (owner uid, permission bits) for path, or None if absent/unreadable."""Verbatim from the shipping source. LocalBox and SshBox both implement exactly this interface; there is no fifth method and no write path in either class.
Why it holds up under an adversarial read.
The graph is identity, never the value.
secret-edges is checked against a denylist of known secret-value shapes (private keys, cloud and API tokens) as a backstop, and an allowlist of what an identity is allowed to look like as the actual gate. A secret's value is never read into a finding or printed anywhere.
Reads cannot run away.
File listing stops at a declared file count and skips anything over 1MB. Text reads are capped in the same way on a remote box. A large or unusual file cannot stall or exhaust a run.
The reach is what you declare.
Orrery only reaches a box a profile names. There is no discovery step that reaches out to boxes you did not declare, and fleet-reach itself treats a reopened edge you had declared closed as drift, not as progress.
What is built, and what is not.
Measure, do not read applies to this page too. The commercial layer described elsewhere on this site (linked secret rotation, a hosted control plane, a GUI) is not part of this repository and is not audited here. What follows is the trust-relevant state of the core, stated plainly rather than implied.
Read-only Box abstraction
Four methods, LocalBox and SshBox, no write path in either.
Value-blind secret graph
Identity allowlist, secret-value denylist backstop, fail-closed.
Self-verifying install
orrery doctor confirms the install stands on a blank box.
AGPL-3.0-or-later core
Zero runtime dependencies, source-available, copyleft.
No phone-home
No telemetry or licensing call exists in the core; the only outbound traffic is the ssh read a profile declares.
Identity-free core
No account, no key, no server-side check is required to run the core at all; it is free software, not gated software.
Linked secret rotation
Does not exist. It would walk the secret-edges graph to rotate a credential everywhere it is consumed. Will not ship until breakglass recovery is proven first, because a half-applied rotation is the one failure mode that can lock an operator out of their own fleet.
Hosted control plane
Does not exist yet. When it ships it is a separate proprietary product, not part of this repository, and will carry its own security review.
Graphical fleet view
Does not exist yet. Today's operator surface is the CLI and the terminal deck.
Found a problem, tell us.
If you find a way to make a check write instead of read, a way to get a secret value scanned or printed instead of just its identity, or any other issue that would undercut what this page claims, report it to orrery@eveningstar.app. Include what you found, how to reproduce it, and its impact. We will confirm receipt and work a fix before any public disclosure timeline.
Because Orrery only reaches boxes a profile explicitly declares and never writes to any of them, most findings will be about the boundary itself: the identity allowlist in secret-edges, the shell-quoting in SshBox, or a way to widen a read past what a check needs.
There is not yet a dedicated security-only inbox separate from general product support; orrery@eveningstar.app is the working channel until that changes.