An agent is a TOML file paired with a markdown prompt file. Create agents/writer.toml: Source
AuthContext
AuthContext is the ephemeral per-request authentication context. It is created when a credential is verified, carries scopes and trust tier, and is never persisted. It resolves to a Principal for attribution. Source
consumer
A consumer is a registered API client stored in the consumers table. Each consumer has: Source
Every piece of work in orxtra is a task with explicit entry and exit points. An agent enters a task by calling start_task and exits by calling end_task. All tool calls between these boundaries belong to that task. A tool call outside task boundaries is a hard error. Source
orxtra
orxtra is a monorepo with 16 sub-projects across five layers: Foundation (10), Orchestration (2), Intelligence (1), Composition (1), Interfaces (2). Each module is independently useful. A consumer wanting only a typed LLM client uses orxtra-transport. One wanting deterministic workflow execution uses orxtra-scheduler. The full system composes all 16. Source
Principal
A Principal is a durable identity row in the principals table. Every actor in the system -- a run, an API consumer, a webhook source, the system itself, or an app-registered kind -- gets exactly one row. Source
The CLI
The CLI is the local-trust path. It creates an operator AuthContext with TrustTier.SYSTEM, all scopes (ALL_SCOPES), and consumer_id=None. This context passes every scope check and resolves to the system principal. The CLI talks directly to the database with no HTTP layer. Source
The SYSTEM tier
The SYSTEM tier is the highest-privilege context, reserved for framework-internal operations and the local CLI operator. Source
workflow
A workflow is a DAG of tasks. Create workflows/summarize.toml: Source