Orkestrai

24/7 Core foundation: opt in to keep the local execution Core and active work available in the system tray after closing every window, and optionally start it silently when you sign in. Settings shows live health and uptime, supports a guarded restart, and keeps Quit Orkestrai as the explicit stop. Recurring schedules start new runs after earlier runs finish; the model does not need to think continuously. Local work pauses during sleep or shutdown and remains subject to valid logins, provider quotas, and pending approvals.

Persistent agent runtimes: leave existing agents interactive, let on-demand agents resume only for messages or durable automations, or ask the Core to supervise a persistent process. Each agent has idle, concurrency, and provider-usage safeguards plus explicit wake and sleep controls.

Continuous team delivery: agent messages go through a persistent inbox. A recipient in the middle of a model turn gets everything pending as one prompt at its next turn boundary, or attached to the response of any bridge call, while the sender is released at once; answers are routed exactly once to the waiting caller or to the asker's inbox (orkestrai inbox, orkestrai reply <messageId>). Task briefings never block the leader on a busy assignee. Builds, E2E suites and packaging wait in a machine-wide queue with orkestrai heavy -- <command>, and orkestrai stats reports delivery and reply latency, inbox depth and throughput.

Floors that land: a Floor starts from the current main checkout, including uncommitted work, and shares installed dependencies. Finishing a task commits its Floor work; floor land merges on a clean checkout or, with local changes, applies only the Floor delta with a per-file three-way merge and changes nothing on conflict. Landing records a commit containing only that Floor's paths. Failed hooks preserve the Floor for retry; automatic retirement preserves local data and active work.

Automatic leader supervision: the Core checks every 15 seconds for unarchived todo/doing cards and a live, idle workspace leader with an empty inbox. After two quiet minutes and a completed provider turn, it reminds the leader when cards changed or a teammate reported a new blocker or result, at least five minutes apart, with persisted fingerprints/receipts in Control Center. Unchanged work gets at most three reminders 30 minutes apart, only while a teammate has been waiting for more than ten minutes. Providers without a reliable turn-end signal require an explicit done activity in the current session. Empty/completed boards stay quiet even with active Floors; custom review columns do not independently trigger reminders. This does not wake manually sleeping agents or override human drafts, pending deliveries, input/permission requests, quotas, suspension, emergency stop, operating windows or restricted conversation profiles. Keep approvals and blockers explicit so unattended work does not repeatedly request them.

Bounded autonomy and encrypted Vault: approve the routine workspace perimeter once instead of supervising every command. Capabilities, roots, hosts, quiet hours, and concurrency form the standing grant; destructive or external actions can require the owner, a reviewer, or Council. Credentials remain in operating-system encrypted storage and reach trusted connectors only through destination-bound SecretRefs. Emergency stop aborts active runs, while a hash-chained export distinguishes exact brokered actions from inferred shell effects.

Native communication integrations: connect Gmail through official OAuth, or bind Slack, Telegram, WhatsApp, GitHub, and HTTPS webhook credentials to explicit account permissions. Persistent agents can read approved inboxes, classify work, send messages, and deliver workspace reports through typed, idempotent connector actions without receiving the raw token or password.

Bounded desktop control: ask an agent to open Calculator or use your already signed-in desktop browser, locally or through Remote. It authors its note and task, prepares the Computer node, and reuses the approved session. You grant OS permissions and the application boundary, not every routine click. Use the Computer node to inspect and operate only explicitly approved apps and displays on macOS, Windows, or supported Linux X11 sessions. Task-bound agent commands are idempotent, screenshots remain confined to the workspace, and audit records omit typed content. Login values can flow from a destination-bound SecretRef directly into the permitted app on macOS and Windows without being returned to the agent; the Linux X11 backend refuses secret typing until it has an equivalent protected channel. See Computer Control for the complete workflow, launch identifiers, risk gates, evidence, and platform limitations.

Tool Workshop: turn repeated work into a native, versioned workspace tool without editing Orkestrai source. Compose approved Gmail, Slack, Telegram, WhatsApp, GitHub, webhook, HTTP, deterministic transform, or confined command operations; validate JSON contracts and fixtures, dry-run the draft, then publish an immutable revision. Agents can activate bounded tools only through an explicit standing publication grant; commands always require owner review. Browser tools operate the same persistent Portal page, with background access enabled by default while the Core runs. Offscreen nodes and minimized windows do not pause agents; explicit visibility-only settings and pauses still apply. Automations and task-assigned agents execute only the approved revision with idempotency, bounded runtime/output, destination-bound SecretRefs, redacted history, and the same security gates and audit trail.

Live agent canvas: arrange real PTY terminals, notes, task boards, browser portals, file trees, loops, and shapes. Connections show collaboration between agents as it happens. Rope physics automatically scales down in dense or offscreen graphs while active conversations retain their visual signal. Settings can force elastic rendering or fully static connections with no physics or animation on lower-power hardware. Duplicate styled shapes with Cmd/Ctrl+D or copy and paste complete visual arrangements while preserving their relative layout. Select any group of nodes to copy or move it into another workspace while keeping its relative layout, internal connections, attachments, images, and native Design content. Terminals start clean and sensitive runtime state is never carried across projects.

Organized workspace creation: create a regular or preset-based workspace directly inside a validated nested sidebar folder, either from the folder header or the New workspace dialog, without an intermediate root-level item.

Persistent Portal sessions: authentication cookies, web storage, and the last navigated URL survive app restarts. Login flows opened with window.open stay in a sandboxed Orkestrai Portal window that shares the same session, while normal foreground or background tab links become a second Portal node in the same Canvas instead of escaping to the system browser. Every Portal has a persistent, editable name separate from its address, so people and agents can target the correct browser by name or node id. The bridge inventories all workspace Portals with explicit connection state, reuses matching URLs, and requires explicit intent before adding another. New and unconfigured Portals allow the whole workspace team to read and interact, including newly recruited agents. Normal use does not require an autonomy policy or assigned task. Explicit agent lists, manual/read-only settings, pauses and enabled security policies remain respected and audited. The Core can operate the same protected profile with the Canvas closed through semantic snapshots and typed browser actions. Per-Portal host allowlists and workspace-confined files keep unattended runs bounded, Control Center records each effect. Agents can fill authorized test-account passwords over HTTPS or loopback using write-only inputs, then verify login in the same Portal. Passwords remain redacted in reads and audit. OTP, private fields, pauses and explicitly enabled security gates remain protected; use manual login when private credentials must stay out of provider conversation history.

Configurable Focus: keep open terminals, boards, notes, portals, files, flows, and usage in vertical tabs by default or optional horizontal tabs, then arrange up to eight live artifacts in resizable right/down splits. Tabs move between panes by drag and drop or an accessible menu. The Focus references canvas artifacts without duplicating sessions, while workspace files remain local editor tabs. Finished Floors retire their nodes instead of inflating the explorer, while active floor agents retain an explicit floor label. The global voice orb follows its active workspace and leader. Its footer keeps every reported Claude, Codex, and Kimi quota window visible without opening a panel.

Safe Floor retirement: orkestrai floor audit (MCP floor_audit) checks all managed worktrees in one call, including ancestry, patch equivalence, local/ignored files, hidden index flags (assume-unchanged/skip-worktree) and live work. Use floor_cleanup or orkestrai floor cleanup --file selected-audit-entries.json --task <taskId> for the explicitly selected safe {floorId, revision} entries. Cleanup requires the live assigned agent, rechecks each worktree, preserves branches, and reports partial failures. It never force-deletes files or treats cherry-pick equivalence as deletion authorization. Resolve blockers and audit again; do not bypass them with shell deletion. Failed retirements stay visible. Request maintenance through an explicit authorized Kanban task. Active Floors alone do not trigger idle-leader reminders after the board finishes or grant deletion/promotion authority. Git scans share a four-process budget and overlapping reads are coalesced. Agent response deadlines no longer acquire an extra 90-second wait; partial turns are not confirmed replies. New Kanban cards also return without waiting for the leader to accept a notification; Control Center records queued, delivered or failed delivery separately. CLI floor remove now requires --task and --revision from the audit, matching the authenticated MCP cleanup contract.

Native code intelligence graph: safely index approved TypeScript, JavaScript, Svelte, and PHP repositories without running project code. Search symbols, paths, signatures, and docblocks, then explore bounded incoming and outgoing imports, calls, instantiation, inheritance, and implementation links in the same Canvas and Focus node. Assisted mode watches settled edits, refreshes atomic revisions incrementally, and makes agent reads wait for the freshest known data; Manual keeps indexing explicit and user-only, while Disabled stops watchers and access without deleting local history. Agents query that exact persisted graph through typed MCP or orkestrai graph; explicitly approved sibling repositories remain separate projects, and arbitrary SQL/Cypher is never exposed. Its Changes view combines the current Git working tree and active Floor worktrees to surface affected symbols, likely tests, and shared-impact conflicts before review or landing, then creates a traceable Review Center review or Kanban task from that bounded evidence. Its Contracts view joins backend routes, frontend calls, generated clients, OpenAPI/Swagger schemas, gateway prefixes, and live API Client requests across approved repositories, while flagging unmatched calls and cross-project conflicts without retaining request hosts, query values, or credentials. Its Quality view adds bounded, confidence-scored evidence for structural duplication, import cycles, coupling, layered-boundary violations, oversized code, security-sensitive execution, and possible dead code. Static environment, file, network-path, database-table, and IPC flows appear as resource nodes without retaining secret values, payloads, hosts, query strings, or source bodies. A local offline semantic index adds intent search with compact vectors and no model download or API key; Assisted mode keeps it synchronized incrementally and agent searches wait for the latest graph revision. Runtime evidence imports confined LCOV, JUnit, traceback, or structured JSON files and overlays coverage, failures, observed calls, and runtime-only relationships without persisting raw test output. Operational intelligence explains relationship provenance, synchronizes graph selections with Monaco, overlays active agents, tasks, and Floors with ownership conflict warnings, and builds reviewed context packages within an explicit token budget for a leader, agent, Council, or traceable task. Retained revision manifests support structural comparison, while named investigations restore the exact project, view, filters, selection, camera, and open source location. Revision stats include bounded scan, parse, resolution, persistence, and cache telemetry; a reproducible benchmark keeps SQLite behind explicit latency gates instead of replacing the local-first adapter on assumption.

Native API client: organize HTTP/REST, GraphQL, WebSocket, and gRPC requests in nested folders with isolated drag-and-drop and context menus. Configure Bearer/Basic/API-key or assisted OAuth 2.0 authentication, cookies, proxy, custom CA and client certificates, protocol-specific messages, environments, source-compatible pre/post scripts, and assertions. Imported Postman JavaScript runs through the official Postman Runtime; Bruno and OpenCollection JavaScript runs through Bruno's official safe QuickJS runtime. Their separate scopes, sendRequest/runRequest callbacks, cookies, collection flow, visualizers, bundled Chai APIs, and legacy helpers remain available, while secret values stay in the operating-system-encrypted desktop vault. JSON, JavaScript, GraphQL, and XML use syntax-aware editors; structured responses are expandable. Persist any number of collection runners with a selected request order, environment, iterations with JSON data rows, delay, and stop-on-failure policy; variables produced by one response flow directly into the next request. Copy cURL; import Bruno, OpenCollection YAML, Postman Collection v2.1, Swagger 2.0, or OpenAPI 3.x; and export Bruno, OpenCollection, Postman, or OpenAPI 3.1 JSON/YAML while preserving unsupported REST metadata and showing explicit fidelity notes. Linked Bruno, OpenCollection, and Postman sources support guarded pull, atomic push, watch mode, and explicit conflict resolution. Agents can import project collections by relative path. For a coordinating workspace beside several repositories, explicitly authorize those roots in Edit workspace and address them through aliases such as @api-tests/bruno; typed edits persist in the actual repository files while arbitrary parent paths stay blocked. Postman environments import and export independently. A versioned .orkestrai-api.json format backs up the complete native collection, including folders, runners, environments, scripts, and history. The same node persists in Canvas and Focus, and connected agents use typed MCP/CLI tools to import, fingerprint-read/replace, synchronize, execute, and export complete collections without receiving stored secrets in plaintext. Format-native requests, folders, scripts, tests, and variables are written back; Orkestrai-only runner configuration remains in the node and in lossless .orkestrai-api.json backups. The JavaScript editor provides runtime-aware completion for bru, req/res, test/expect, and pm; scripted tests live beside structured assertions and round-trip through Bruno and Postman. Bruno/OpenCollection GraphQL, WebSocket, and gRPC requests round-trip. Both source runtimes expose their bundled script libraries; Postman team Package Library, hosted datasets, mocks, and other cloud-owned state still require Postman's backend because they are not stored in a portable collection file. Bruno scripts deliberately stay in its official safe QuickJS runtime: unsafe NodeVM access to the host filesystem, processes, and arbitrary local modules is not enabled.

Native video workflows: choose fal.ai, BytePlus ModelArk or Higgsfield with separate encrypted accounts, reviewed model contracts and cost previews. Search the published fal.ai video catalog, including Seedance 2.5, and configure each model's official input contract. Bind workspace Images, Videos, audio files and context Notes. Configure credentials in the desktop vault, workspace/model/agent permissions and cost reservations. Review outgoing data and estimates, follow persistent jobs, recover downloads without generating again, and play delivered workspace media in Canvas or Focus. CLI/MCP agents use the same revisioned contract. Video requires a funded API account for the selected provider; it does not change Codex image generation. Provider-specific limits are documented in-app. Approved characters keep versioned visual and voice references. Drag a character from the shared library into another workspace to copy its complete native reference bundle without granting access to credentials or paid generation.

Creative production: native ordered storyboards, comparison and human review, contextual image edits, shot direction and approved brand kits share Canvas and Focus. Save versioned workflows with named local inputs, a script and format; reuse them as editable storyboards without copying credentials or starting jobs. The generation queue shows actual image/video state and download recovery. Assemble delivered clips in a native Video sequence: reorder, trim, caption, adjust audio and export a new MP4 locally, preserving the source files. Assigned agents can also attach an existing edited video, such as renders/final.mp4, through video_workflow_import or orkestrai video import: no new generation, upload or file move. The bridge exposes the configured project root; briefs, prompts, montage sources and final exports belong there by default. Removing a Canvas node keeps the file, but agents must not silently reuse historical media that is no longer on Canvas.

Native image workflows: connect Notes, ordered PNG/JPEG/WebP Image references, and a live Codex agent to a Generate images node on the same canvas; the same node opens in Focus. A connected Codex can create and configure the workflow, attach, remove, or reorder context and references, request one to ten outputs, run or cancel generation, and remove the workflow through the same typed bridge. It uses its authenticated built-in image_gen.imagegen tool. Delivery presets produce exact Instagram square (1080x1080), Instagram portrait (1080x1350), Stories/Reels and TikTok (1080x1920) PNGs, with custom dimensions also available. Because the native tool does not guarantee exact pixels, the prompt defines a measurable safe area and Orkestrai validates the native aspect ratio before delivery. A close match is resampled without cropping while preserving its original under .masters/; an incompatible frame is sent back to ImageGen for safe recomposition or outpainting instead of cutting or distorting content. Every result is validated independently; when the node requires transparency, Orkestrai decodes the PNG and verifies real alpha pixels, then directs Codex to correct an opaque or fake-checkerboard result up to three times using another native image_gen.imagegen edit with the rejected image as its only reference. Python and other local pixel-processing tools are explicitly forbidden for that correction. Machine feedback tells ImageGen when a visible checkerboard is baked into an opaque file and escalates the native cutout prompt if the first correction remains opaque. With multiple references, ImageGen first composes the foreground on a uniform white matte and then removes that matte in a separate native edit before final alpha validation. Orkestrai never asks for or stores an image API key. It validates the preallocated workspace destinations before outputs return as connected Image nodes with provenance and bounded run history, ready to feed another branch. Humans, the bundled CLI, and typed MCP tools operate that same visible workflow without a parallel automation state. The guided use case can materialize and execute a complete Character → Brand → Carousel chain, including reusable briefs, a sample logo, persisted outputs, and automatic reference wiring between stages. Every interactive Codex terminal receives the MCP launcher from the current Orkestrai installation as a session-only override, so stale global Codex configuration cannot hide the image workflow tools.

Integrated mobile devices: add a persistent Mobile Device node from the Canvas toolbar; Focus lists and opens that same node and session. Control iPhone and iPad Simulators on Apple Silicon Macs, or Android AVDs and explicitly authorized physical devices on macOS, Windows, and Linux. Stream the screen, send gestures and system buttons, install and launch workspace apps, manage permissions, inspect bounded logs and accessibility data, and save screenshots. Android uses Android Studio Platform Tools plus the bundled scrcpy server; the live screen is decoded with WebCodecs and fits either surface by default. Agents run the same workspace-scoped flow through the bundled CLI or MCP tools. A previously attached virtual device resumes on the same Mobile node after a Core restart. Unloaded workspaces stay stopped, another workspace's device is not taken over, and physical devices still require confirmation. Recovery failures are shown with a retry action instead of an endless loader.

Operational Control Center: inspect every agent's current task, state, state duration, provider, role, and usage. Its persistent communications inbox projects every handoff into a canonical, idempotent message envelope and proves whether it was queued, delivered, acknowledged, replied to, or failed. A semantic activity timeline explains messages, tasks, reviews, decisions, Git, and system events without waking idle terminals after restart. The global Attention Center gathers questions, permission requests, blockers, and failures from every workspace, expands the full original message in place, and keeps source navigation separate when its agent or task still exists. Command/Ctrl+K recovers the same history with structured filters. Counts include only the Ground floor and currently active Floors; historical floor nodes stay archived for task attribution instead of appearing as agents.

Traceable Workstreams: every active Kanban task becomes a live delivery view in Focus, combining its assignee, Floor and branch, semantic history, Council decisions, Review Center evidence, exact Git revision, tests, risks, and linked files. It projects the existing records instead of creating a second tracker, and explicitly counts work that is not yet linked to a task.

Sourced workspace memory: preserve reusable decisions, facts, preferences, constraints, references, and lessons with explicit evidence, immutable revisions, conflict protection, search, and archive history. Agents query the same memory on demand through typed MCP/CLI tools instead of receiving an expensive full-memory prompt on every turn.

Traceable annotations: review code and native Design feedback from one Annotation Center in Canvas or Focus. Every item keeps its canonical artifact, author, target, captured revision, resolution state, and stale-code warning; opening it returns to the original review or Design document.

Versioned Team Packs: turn a working workspace into a portable team with agents, roles, skills, task stages, routines, MCP configuration, and layout. Semantic versions, release notes, immutable history, SHA-256 verification, bounded imports, and runtime-state stripping make packs safe to evolve and share without carrying live sessions or credentials.

Persistent agent Huddles: bring a person and selected agents into one voice-assisted room with a facilitator, agenda, targeted turns, dictation, optional local TTS, and a durable bounded transcript. Agents contribute through typed CLI/MCP tools, remote participants use separate encrypted view/speak/manage permissions, and the completed conversation can become linked Kanban and Workstream evidence.

Encrypted workspace sharing (experimental): host an end-to-end encrypted session, choose a browser/mobile or installed-app invite, approve the device fingerprint, and assign a Viewer, Collaborator, Operator, or Administrator role. The installable Remote PWA follows sanitized team state, tasks, reviews, activity, provider usage, and leader messages. Team details expose each agent's current focus, recent semantic events, and bounded coordination totals without sending internal message bodies or terminal output through the relay. Responsive navigation keeps every area reachable on phones and tablets, with a readable per-column task view and explicit return actions. Its pairing key stays non-extractable in the browser and the invitation secret is removed from the URL before connecting. Installed-app invites open Orkestrai automatically; guests can also paste one through Workspace → Join remote workspace. Operators share the app's Conversa: the team channel and each agent's direct conversation, with questions, answers and delivery state. What they write there reaches the agent like a message written in the app, whole messages and older history load on demand, and the agents' messages to each other stay on the host. They also answer and decide what waits in Needs you. Dictation is available for leader, agent, and terminal input through the host's local STT without exposing plaintext audio to the relay; terminal dictation inserts text without submitting it. Administrators can start or restore an agent. Raw terminal control is a separate Administrator-only switch for each approved device, disabled by default, responsive to its viewport, rate-limited, limited to one terminal, and audited. Files, notes, portals, credentials, private URLs, and local paths stay on the host. Access is revocable and every command is audited.

Traceable automations: trigger work manually, on a schedule, from task or message events, Git commits, GitHub pull requests, webhooks, file changes, or provider usage thresholds. Actions can prompt an agent, create a Kanban task, or notify the desktop. Database-backed runs use renewable leases and checkpoints, recover after a stopped worker or sleeping computer, start or resume closed agents, and expose cancellation, bounded backoff, dead-letter state, and replay in execution history. GitHub credentials remain encrypted in Electron secure storage instead of the workspace database.

Git Review Center: inspect staged and unstaged changes, compare files in a Monaco diff, create reviews linked to tasks and assignees, leave persistent file and line comments, and approve, reject, or request changes. Feedback is routed back to the responsible live agent without losing the review history.

Native Git workspace: add one persistent Git node to Canvas or Focus to manage changes, commit history, branches, tags, remotes, stashes, and the worktrees owned by Floors. Every destructive operation is previewed against an exact repository revision; WSL uses the selected distribution, and agents receive the same guarded operations only from their authenticated live terminal while working on an assigned task.

Portal Design Mode: point at the exact interface element that needs work, review its cropped screenshot and safe visual context, then track feedback in a new leader-triage task, a task assigned to an agent, or an existing task. Browser secrets and hidden state stay excluded.

Native Design Mode: create structured interface documents directly on the Canvas and open the same artifact in Focus. Draw vector paths with direct anchor, segment, and Bezier-handle editing; box-select and transform vector points, continue open paths, resize layers directly, and edit text in place, combine shapes, use masks, gradients, effects, snapping, guides, auto layout, grids, and responsive constraints; import SVGs as editable hierarchical vector layers, group or ungroup them, find and replace matching colors across the design, and copy or export a selection as SVG or PNG. Create typed design tokens in collections with multiple modes, aliases, presets, DTCG/CSS import, and DTCG/CSS/Tailwind export; audit repetition and bind compatible properties. Turn frames into reusable components with linked instances, properties, variants, slots, and local overrides. Publish versioned libraries only to authorized workspaces, and statically extract CSS variables, Tailwind tokens, and Svelte, React, or Vue component contracts without executing project code. Switching a mode updates every bound layer immediately, components and tokens are searchable, and agents use the same revision-safe operations through MCP. Organize large files with first-class pages and a searchable, collapsible hierarchy; rename, reorder, reparent, copy, cut, paste, and duplicate through the same revisioned command bus used by the UI, CLI, and connected agents. Hover layers before selecting them, Command/Ctrl-click through nested or overlapping artwork, rotate directly with 15-degree snapping, inspect spacing with Alt/Option, follow labeled smart guides, and align, distribute, or tidy complete hierarchies without detaching their children. The compact contextual inspector supports draggable numeric values, calculations, fixed/hug/fill sizing, min/max bounds, complete auto layout, rich text controls, and multi-selection edits. Its color workflow includes Hex, RGB, HSL, alpha, native eyedropper, recent and document colors, variable binding, and editable solid, linear, and radial gradient stops. Raster images remain reusable assets, while full documents export to SVG, PNG, JPEG, WebP, or PDF. A designer or leader can edit the exact same revision through typed Orkestrai tools while the UI updates live. Documents, assets, thumbnails, and history stay under .orkestrai/designs in the workspace.

Guided UI exploration: start from one objective and create a linked spec, eight progressive Kanban tasks, and three native directions: Clarity, Expressive, and Efficient. Each agent first renders one desktop and one mobile concept through compact semantic composition; the Canvas shows waiting, working, stalled, and ready states. A revision-aware visual review gate accepts or returns each concept with traceable feedback, while the automatic audit is kept explicitly structural. Approval records one delivery target and can dispatch the tracked expansion task to the leader. An eight-part readiness checklist then requires platform frames, a visible Brand board, typed and bound tokens, components, a prototype, applied framework code, and approval of the current revision; incomplete expansion, implementation, and validation tasks cannot be closed. Large directions remain sharp and navigable in their Canvas nodes and in focus mode by trackpad, Hand tool, Space-drag, fit-all, and zoom down to 2%.

Live Design collaboration: see human and agent presence, cursors, and selections; follow another participant; discuss a page or layer in anchored comment threads; and review visual proposals as structural diffs before an explicit approval applies them atomically. Short layer leases prevent conflicting edits. Proposals can move into Council or an isolated Git Floor, while the encrypted Remote Companion receives only sanitized summaries and separately granted View, Comment, Propose, Edit, and Decide permissions.

Focused prototype and inspect workflows: draw an interaction directly from a selected layer to its destination frame, select its visible canvas connection, and refine triggers, actions, transitions, flows, and motion in Prototype. Inspect keeps accessibility, resolved tokens, component and Code Connect contracts, Figma provenance, generated artifacts, and copyable CSS together. Reviews and quality history open as contextual drawers so they do not replace the layer properties needed during the decision.

Official Figma interoperability: the managed official Figma MCP gives compatible agents direct design context, while Inspect → Figma inspects links and imports selected pages or frames, vectors, assets, styles, variables, components, variants, instances, and external-library identities into the same Orkestrai document. Linked sources compare remote and local hashes before selective synchronization, and existing Code Connect mappings form a Figma node → Orkestrai layer → code relationship. A bundled first-party, loopback-only plugin transfers live selections, editable SVG or structural JSON, opens an Orkestrai document on a new Figma page with native design resources, and sends only linked local changes reviewed in Orkestrai back to the current file. REST credentials stay encrypted in the operating-system vault.

Design delivery and visual validation: import HTML/Tailwind, Svelte, React/JSX, or Vue structure as editable native layers, then generate Svelar/Svelte 5, React, Next.js, Vue 3, or HTML/Tailwind from a selected frame with a complete preview before writing. Existing component mappings are reused first, generated files open in Monaco, and the live implementation can be captured from a Portal or attached iOS/Android device. Pixel diff and an adjustable overlay link the visual result to a Kanban feedback task or the Review Center Git diff. Claude, Codex, Kimi, and other connected agents use the same revision-safe import, preview, and protected-write flow through the bundled CLI or typed MCP tools.

Interactive prototypes and native motion: connect any layer to another frame, overlay, scroll target, history action, or variable mode using click, press, hover, and timed triggers. Preview flows in a focused player with transitions, fixed layers, overflow, hotspots, and device framing, then share a self-contained read-only HTML prototype. Reusable motion tokens, per-layer tracks, keyframes, easing, CSS keyframes, and Motion.dev output all remain inside the same revisioned Design document, editable by people and connected agents without a parallel prototype file.

Council decisions: open Council from the Canvas toolbar, the workspace in Focus, or Cmd/Ctrl+K, then ask two to five real agents for independent, budget-limited perspectives on one task or objective, compare the same evidence, risk, test, disagreement, and confidence contract, then record the human selection, consensus request, or rejection. Implementation prototypes stay in isolated Git floors and land only after an explicit safe preview.

Universal search: press Cmd/Ctrl+K to find workspaces, agents, tasks, notes, roles, skills, files, settings, and commands, with recent and favorite items plus direct actions to open in the current pane, right, or below.

Rich local editor and previews: browse the workspace's native file tree and open files directly in local Focus tabs, without creating canvas nodes. The lazy-loaded Monaco editor keeps undo, cursor, dirty state, find/replace, formatting, outline, minimap, wrapping, and optional autosave. Preview Markdown, PDFs, and images offline; binary files show safe metadata and open through the system application.

Shared reference material: drop, paste, or select images, PDFs, files, and HTTP/HTTPS links in agent prompts, task cards, notes, and composers. Files up to 10 MB stay inside the workspace under .orkestrai/attachments/, and agents receive each message attachment's absolute path in their own runtime or the URL.

Maestro mode: assign a leader that can propose a team, recruit agents, delegate complete task briefings, coordinate work, and dismiss agents when the work is done. Recruitment inherits the leader's active Floor and is confirmed only after the provider terminal starts; task assignment restores an offline agent and moves to progress only after the briefing is delivered. Specialists implement; leader assignments through CLI/MCP require explicit leaderWork=coordination|review (--leader-work in the CLI). Assignment already dispatches the briefing, so a duplicate ask is unnecessary. An approved plan includes routine owned dev-server and Portal verification work; explicit security gates, provider exclusions and budgets still apply.

Ready-made teams: start or expand a workspace with complete Product, Campaign and launch, Brand and design, Content and SEO, React, Next.js, SvelteKit, Svelar, Laravel, and Orkestrai Contributing presets. Their agents start with autonomous full access and native system/developer-level roles, with validated Kimi agent-file frontmatter and without long instructions blocking the terminal as pasted text. The lead receives and assigns the complete initial task without repeated prompts.

Workflows that fit the work: name, color, and reorder up to ten board stages. Leads and agents discover and update the same stages automatically.

Operational team views: install specialized roles from a 12-role catalog or discover reusable .orkestrai/roles/ definitions from another selected project folder, then inspect each task title, stage, assignee, and Git state across every floor. Imported roles stay bounded, validated, and confined to the selected project.

Native agent bridge: the bundled orkestrai CLI and MCP server expose typed commands for messages, tasks, notes, portals, mobile devices, floors, roles, and desktop notifications. Codex receives the Orkestrai and official Figma MCP definitions as ephemeral launch overrides, so workspace provisioning never rewrites the user's global ~/.codex/config.toml. Automatic handoffs use one serialized delivery path; on Windows and WSL, Orkestrai waits for the TUI composer to settle and confirms the exact prompt in the provider transcript before reporting that the message was delivered. Task-scoped handoffs expire instead of reaching an agent after that task was completed or reassigned, and late status cannot reopen completed work.

Parallel workspaces: agents continue running when you switch to another workspace, with activity indicators and native notifications.

Mixed Windows and WSL runtimes: choose a default runtime per workspace, then let each terminal inherit it, use native Windows, or target an exact WSL distribution and Linux project path. Provider discovery, sessions, resume, Council, recruited agents, and the bridge follow each terminal, so one team can combine tools installed across Windows, Ubuntu, Debian, or other distros. Orkestrai validates the selected Linux environment before spawn and restores only a conversation confirmed inside that distribution's own home. Maestro recruitment validates and starts the PTY in that same environment instead of leaving a hidden or non-running agent record behind. Windows packages include a pinned console Node runtime verified by SHA-256; WSL bridge launchers use that known runtime when available and fall back to Node inside the selected distribution, never the GUI-subsystem executable that discards command output.

Git floors: isolate work in Git worktrees, inspect conflicts, and land completed changes from the canvas.

Local voice: dictate into any text field or use the no-focus workspace shortcut for the leader, then listen to replies in Brazilian Portuguese, US English, or Latin American Spanish. Terminal dictation can optionally submit with Enter; regular text fields remain insert-only. Choose and test the input and output devices under Settings → Voice; every dictation surface, preview, and spoken reply follows that preference and falls back safely if the device is removed. Dictation records direct PCM through the same path as the live input meter, normalizes quiet speech, and distinguishes an input with no signal from speech that could not be recognized. The voice orb's pin badge opens its position controls directly, while the tooltip also reveals the platform shortcut. STT and TTS run locally.

Quota-aware delegation: pin Claude, Codex, and Kimi usage to the canvas, configure a source, fallback, 5-hour/weekly/monthly window, and threshold, and let the leader consult the same recommendation through the CLI or MCP before assigning new work. The same panel inventories Antigravity, Cursor, Devin, OpenCode, and Cline and explains their documented CLI, admin-API, or model-provider usage source without inventing a percentage. Leader routing stays at the top of the node, while provider details scroll independently in compact nodes without zooming the canvas.

Production Design quality: audit naming, clipping, overlap, WCAG contrast, and accessibility, jump to the affected layer, start from complete editable product, marketing, mobile, and design-system templates, and rely on automatic backups, recovery, schema migration, bounded history, and incremental rendering for large documents. Agents use the same typed audit and template commands.

Custom appearance: start from a coherent graphite-and-gold dark system or a high-contrast light palette, choose the other built-in themes, or duplicate one and edit semantic tokens with live preview and JSON import/export.

Readable terminals: choose 1 of 11 complete ANSI palettes from the compact terminal options menu, alongside provider, role, reload, and Maestro controls. Font metrics settle before PTY reattachment so the cursor remains aligned after switching between Canvas, Focus, Settings, and documentation.

Reusable terminal commands: save searchable commands for one terminal or globally, execute them manually in any terminal, or opt pure shells into a once-per-session startup command. Agent conversations never auto-run saved text, and the UI warns against storing credentials in plain-text commands.

Project-isolated environments: shells retain the user's operating-system environment and the Orkestrai bridge without inheriting the desktop server's private configuration. Framework .env files stay authoritative, including Laravel's APP_KEY for encrypted application data.

Operational controls: manage local portal ports, configure recurring routines, and install skills from the marketplace.

Provider Center: detect registered CLIs locally, follow OS-aware installation and official sign-in guidance, inspect public service status, and route named account profiles without persisting credentials in canvas data. New agents inherit their same-CLI leader's account in Canvas, teams, presets and CLI/MCP recruitment. Explicit selections take priority; use recruit --default-profile (MCP: defaultProfile: true) to deliberately use the default account. Existing agents keep their accounts. Switching one Claude agent between your own profiles now retains its exact saved conversation, tool results and tasks. Credentials and unrelated sessions are never copied. Native and WSL reads follow the selected profile; conflicting destination history aborts the change. CLI/MCP: agent-profile --profile <name> --task <id> / agent_profile_switch (specialists: self; authenticated leaders: teammates).

Personal agent toolbar: choose any service from one compact Agents menu and pin up to four ready favorites globally across workspaces and restarts.

Replaceable providers: switch a team member from Claude to Codex, Kimi, or another installed provider while preserving its role, floor, and connections.

Session continuity: providers with an implemented conversation reader resume their exact session after restart. Other providers start a new conversation; Orkestrai never resumes a neighboring agent's latest session by directory.