Languages and guards

Supported langspec languages, orch guard verbs, notify adapters, and installed hooks.

Languages, guards, notify, hooks

Generated by go run ./cmd/orch-docs. Each section names its source of truth in the code.

langspec languages#

Source: public orchemax-orch langs/ (vendored into client/internal/langspec/). 29 languages today — PRs add more: c, cpp, csharp, dart, delphi, elixir, go, groovy, haskell, java, javascript, julia, kotlin, lua, objc, perl, php, powershell, python, r, ruby, rust, scala, shell, solidity, swift, typescript, vb, zig.

orch guard * verbs#

Source: the CLI reference (cli.md) — each verb's short description IS what it checks, read straight from client/internal/cli/cli_guard.go.

  • orch guard add-all — Deny blanket git add (-A/.) when cwd is a shared repo
  • orch guard allow — Deny an orch:allow override marker that silences nothing (unwaivable gate, or no reason)
  • orch guard artifacts — Deny disposable build junk (.o, .pyc, .exe, …) beside source
  • orch guard banned-stack — Deny an import or manifest dependency the owner declared banned
  • orch guard code-lang — Check code identifiers/strings against workspace.code_lang
  • orch guard comment — Deny if exported shared symbols lack a one-line purpose comment
  • orch guard comment-prose — Note long/narrative comment blocks (advisory, never denies)
  • orch guard conflict-markers — Deny git merge-conflict markers left in a file
  • orch guard control-bytes — Deny invisible control bytes in source (except tab/LF/CR)
  • orch guard cross-project — Deny a file inside one registered project importing another registered project
  • orch guard ddl — Require seeder/repository companion for migration/CREATE TABLE changes
  • orch guard docs — Deny an unreferenced new doc, or a header count that does not match the file
  • orch guard dup — Deny if file duplicates a shared symbol; report copied function bodies (clones)
  • orch guard encoding — Deny missing UTF-8 charset / mojibake in HTML, email, and source a compiler reads in a legacy code page
  • orch guard env-drift — Deny keys lost or emptied between an .env example and its instance
  • orch guard explain — Say what every rule would answer about one file, and whether a commit carrying it would be denied
  • orch guard gofmt — Deny a Go file whose content is not what gofmt would write
  • orch guard hooks — Install git pre-commit/pre-push hooks that run orch guard
  • orch guard hooks install — Write .git/hooks/pre-commit + pre-push (orch-marked)
  • orch guard hooks run — Run pre-commit checks on staged files (used by git hooks)
  • orch guard hooks status — Show whether orch git hooks are installed
  • orch guard hooks uninstall — Remove orch-marked pre-commit/pre-push hooks only
  • orch guard ide-hook — Internal: Claude/Cursor wire entry (soft-skip outside workshop)
  • orch guard json-dup — Deny a key declared twice inside one JSON object
  • orch guard lang — Check workshop docs against workspace.docs_lang
  • orch guard litter — Deny new agent-scratch files/dot-directories outside .sandbox// or docs
  • orch guard lock — Deny if shared/** path has no valid lock for --holder
  • orch guard machine-path — Deny one machine's absolute home path (Users/, /home/) in a versioned file
  • orch guard minimal-code — Report a single-implementation interface, an unread field or a single-use wrapper (advisory)
  • orch guard principles — Show which elemental principles orch enforces and which are guidance
  • orch guard profile — Show or set guard.profile in orch.yaml
  • orch guard race-test — Report concurrency added to a package whose tests only run sequentially (advisory)
  • orch guard reproduce — Deny a change whose own new tests pass against the pre-change source
  • orch guard rules — List and validate the workshop's own gates (.orch/gates/user/manifest.json)
  • orch guard rules run — Dry-run the user gates over an explicit file list
  • orch guard schema-bump — Deny a column added to a table definition with no schema version bump
  • orch guard scope-growth — Report a change set that outgrew its ledger item with no ask raised (advisory)
  • orch guard secrets — Deny a credential (provider key, PEM block, high-entropy assignment) in source
  • orch guard shared-brand — Deny registered project id / path references inside shared layers
  • orch guard shared-root — Deny loose source files at shared-layer roots (must live in a subfolder)
  • orch guard shared-shadow — Deny a project file whose path mirrors one already under a shared root
  • orch guard shell-check — Internal: pi-extension sibling of ide-hook; reads a shell command on stdin
  • orch guard signature — Deny non-constant-time comparisons on a signature/HMAC/token
  • orch guard template-drift — Deny a key-set mismatch between a .template.json/.example.json and its instance
  • orch guard test-dup — Report a test whose body repeats another test's, literals included (advisory)
  • orch guard test-residue — Deny paths a test run creates under a source root, gitignored included
  • orch guard tracker — Validate TRACKER state table (T1–T5: status · SPEC · evidence · no prose · row shape)
  • orch guard unproven-gate — Deny new gate source added with no test touched in the same change set
  • orch guard unwire — Remove what Orchemax wrote to disk: IDE hook entries, .mcp.json Orchemax servers, git hooks — workshop and every registered project
  • orch guard upsert — Deny ON CONFLICT/ON DUPLICATE KEY/MERGE upserts with no matching UNIQUE/PK
  • orch guard weakened — Report a test that survived a change and now verifies less (advisory)
  • orch guard wire — Install marked git/Claude/OpenClaude/Cursor/Copilot/agy adapters for this workshop

Notify adapters#

Source: client/internal/config.AgentNotify (full field reference in config.md) and its defaults, config.DefaultAgentNotifyConfigs(). Modes: http (single request or a steps chain), shell (cmd template), file (drop a rendered file at path), none.

preset mode
agy file
claude file
codex file
commandcode file
copilot file
cursor file
grok file
kimi file
mimo file
openclaude file
opencode http
zcode file

Hook events orch installs#

Source: grep of client/internal/harness/wire.go for the Claude Code hook event names it writes into .claude/settings.local.json (project scope) or ~/.claude/settings.json (user scope).

  • PreToolUse
  • PostToolUse
  • PreCompact
  • SessionStart
  • SessionEnd
  • UserPromptSubmit
  • Stop
  • Notification

PostToolUse and PreCompact are separate opt-in consent (context.hooks.post_tool / context.hooks.pre_compact — see config.md); PreCompact is what makes orch memory condense run automatically.