Add safe role-based workflow launch by Thibault1818 · Pull Request #3 · Thibault1818/ORCH

Thibault1818 · 2026-08-05T18:57:39Z

Summary

add a nontechnical workflow wizard, semantic role roster, presets, and explicit binding rotation
validate trusted deterministic checks before any model boundary and keep enabled prompts out of argv
add durable roster receipts/recovery, richer doctor/status output, regression coverage, and exact-SHA install CI

npm run typecheck
npm test -- test/security/security-regression.test.ts
npm test (2,141 passed, 2 skipped)
npm run build:dist and reproducibility check
npm pack --dry-run --json --ignore-scripts
npm audit --omit=dev
exact 403e5aeee1d8837dcc6676475b06957e67c553bf Git install in an isolated prefix with fake Codex/Claude workflow

Grok and Antigravity remain disabled because secure stdin prompt transport is not empirically proven
native resume remains opt-in after an external end-to-end capability probe
real paid model compatibility is not claimed from fake CLI tests

zmonteiro added 8 commits August 5, 2026 20:53

feat(workflow): add safe role-based launch

27b7b89

fix(ci): initialize exact-install workflow fixture

8a93bc1

fix(ci): keep workflow state outside fixture commit

403e5ae

fix(ci): make workflow smoke deterministic

f13af61

fix(workflow): close final launch and accounting gaps

0c149bc

fix(workflow): prove argv safety and exact fallback usage

02b68aa

fix(security): complete GA execution safeguards

22704d5

fix(security): close final GA bypasses

8e687a4