Golden path:
orro setup --home .witnessd --json
orro flow "<goal>" --write-scope "<glob>" --adapter codex --json
orro check --home .witnessd --jsonorro demo shows the whole guardrail idea in 30 seconds with no AI adapter.
Use orro status for roadmap/evidence-bound progress.
Canonical ORRO flow:
setup -> flow -> check -> handoff
For explicit composition, use orro flow or orro team go; proofrun and
proofcheck must share one run directory.
orro advise "fix parser bug" --repo . --home .witnessd --json
orro init --home .witnessd --depone-root ../Depone
orro doctor --home .witnessd --json
orro engine-lock --home .witnessd --out .witnessd/orro-engine-lock.json
orro scout "fix parser bug" --repo . --home .witnessd
orro flowplan "fix parser bug" --root . --profile code-change --out .witnessd/workflow-plan.json
orro proofrun "fix parser bug" --repo . --home .witnessd --workflow-plan .witnessd/workflow-plan.json
orro proofcheck .witnessd/runs/<run-dir> --home .witnessd --out .witnessd/runs/<run-dir>/proofcheck-verdict.json
orro handoff .witnessd/runs/<run-dir> --out .witnessd/runs/<run-dir>/orro-handoff.json
orro status .witnessd/runs/<run-dir> --home .witnessdSupport surfaces:
orro advise: recommend the smallest safe workfloworro init: setup readiness metadataorro doctor: readiness checkorro engine-lock: distribution metadata write/checkorro flowplan --profile review-only --lane-adapter gemini: route a Gemini read-only review lane through witnessdorro flowplan --profile review-only --lane-adapter agy: route a Google Antigravity read-only review lane through witnessdorro auto --dry-run: recommendation onlyorro auto --once: one safe post-run step onlyorro auto --until-complete: bounded proofcheck/handoff loop onlyorro status <run-dir> | --latest: human-facing summary
Canonical invocation rule: use the ORRO-owned orro command for operator-facing
commands. Wrapper-owned commands (boundary, self-test, and explicit
delegate) are handled by ORRO; workflow commands are delegated to witnessd,
with orro delegate -- <command> available when that delegation must be explicit.
orro auto v0 does not run proofrun or workers.
Formal handoff requires a passing bound proofcheck-verdict.json.
The review-only profile may produce a Gemini or Antigravity read-only review
lane and a signed review-receipt. That receipt is advisory review signal,
not proofcheck, not verifier truth, not execution evidence, and not approval.