OrchestKit AI Development Toolkit

The README gives unusually concrete disclosure for the 171 broad lifecycle hooks: what they inspect, the local JSONL destination, rotation, opt-outs, and the explicitly configured network paths. It says prompt and file contents are discarded and common credential stores are not read. SECURITY.md adds private reporting, response targets, runtime-dependency scope, SHA-pinned Actions, CodeQL, dependency review, and secret auditing, supporting full scores for data-flow, sensitive-data, and dependency-security handling. Least privilege is not full because hooks span 32 events, the local log has no global kill switch short of disabling the plugin, and the ork-mech profile combines approval=never, workspace writes, and network access; it retains a sandbox and avoids the total bypass flag, but remains broad. Confirmation is specifically documented for setup writing MCP configuration, not for every consequential action across all skills, agents, and hooks. External effects are thoroughly disclosed and remote sync defaults off. Uninstalling, disabling, and non-overwriting installers provide partial recovery, but there is no universal rollback contract for agent-made changes. The author, repository, contributor copyright, and support paths are named; source attribution is not full because publisher identity remains unverified by the stated enterprise registry.

The README, package metadata, and test sources cover version checks, argument constraints, hermetic fetch stubs, direct execution of built artifacts, exit codes, rate limits, problem details, transport configuration, and an npm publication-normalization failure mode. Failure reporting is especially concrete for unknown commands, unreachable APIs, invalid API keys, and Retry-After. Dependency availability is thoroughly documented through Claude Code and Node/Python floors, host-specific Context7 packaging, missing-key behavior, marketplace cache lag, stdin blocking, and linked-worktree git-directory requirements. Self-consistency loses a point because the object description says 106 skills while the README and package metadata say 107. The README also requires careful host-specific interpretation when saying the Claude plugin ships no MCP configuration but the Codex plugin includes Context7. Tests are treated only as static evidence and were not claimed to have run.

The material separately covers Claude Code, Cursor, Codex, pi, and skills.sh with a host matrix, installation paths, command syntax, role, hook, rule, and MCP differences. It distinguishes the full plugin, portable workflow pack, and starter 12, providing strong audience and scenario coverage. Boundaries are explicit about hosts without hooks or agents, fallback to training data without Context7, pi skills excluded from model invocation, separately installed Codex roles, and the mechanical-work scope of ork-mech. Narrow descriptions, explicit invocation names, auto-routing, disable-model-invocation markers, and trigger-evaluation scripts support precise activation. Version floors, restarts, headless stdin, linked worktrees, MCP precedence, and non-overwriting installers provide thorough environment fit.

The README has a clear contents list and well-separated quick start, host matrix, configuration, observation disclosure, installation, FAQ, development, release, and community sections. Installation notes include commands, restarts, verification, and host-specific traps; examples and FAQ cover both ordinary and advanced operation. Naming is generally explained but not fully stable: ork, ork-alpha, ork-codex, implement, /ork:implement, and $ork-implement coexist, and the documentation itself spends substantial space resolving version and naming confusion. Limitations are unusually explicit, including no LTS, security fixes only on the newest release, solo maintenance, cached snapshots, misleading MCP connection success, host hook gaps, and non-gating benchmarks. The full MIT text agrees with both package manifests. The README shows detailed beta releases and points to complete history. SECURITY.md clearly identifies solo maintenance, response targets, upgrade policy, and disclosure paths; unknown registry identity is not treated as suspicious.

Host-specific commands, doctor diagnostics, JSON output, meaningful exit codes, quota reporting, and copyable configuration make the outputs highly usable. The combined catalog of skills, agents, and hooks plausibly adds substantial functionality over a bare coding agent, while on-demand loading, the starter 12, and the small Codex pack show attention to overhead. Marginal value is not full because claims such as automatic production-quality patterns and zero overhead are primarily README assertions; the supplied tests focus on CLI, packaging, structure, and safety contracts rather than demonstrated real-task improvement across the large catalog. Cost disclosure covers Context7 quotas and pricing, an approximately 150 ms cold-start probe, process fan-out, and context-loading choices, but does not aggregate token cost, maintenance burden, or the ongoing cost of 171 hooks, so cost-benefit is adequate rather than exhaustive.

Many claims are tied to concrete configuration names, scripts, environment variables, tests, versions, error messages, and release entries. Generated README markers and a claimed CI staleness check further improve traceability. Full traceability is not earned because the supplied evidence omits the principal hook implementations, lockfiles, complete workflows, and test results; absolute claims such as no compiled endpoint, no content recording, and install-time Snyk scanning remain largely project assertions here. Version and authorship are corroborated across README, package.json, and pyproject.toml, while CLI behavior is represented in both unit and E2E tests. The skill-count mismatch and lack of independent sources limit cross-source corroboration. The prose often labels observations as measured, advisory, optional, prerequisite, or policy and explicitly distinguishes tests from execution, but marketing comparisons and several absolute security statements are not directly demonstrated by the supplied implementation files.