Orbit Script Processing Flow
Purpose: load this when debugging loop behavior or explaining how the generated scripts interact. It summarizes lifecycle flow without repeating the full templates.
Contents
- Overall lifecycle
- Recovery flow
- Verification structure
- Inter-script relationships
- Key design points
Overall Lifecycle
| Stage | Main actions | Key guardrails |
|---|---|---|
| Bootstrap | create loop directory, goal.md, progress.md, state.env, optional verify.sh, always run-loop.sh and notify.sh |
do not overwrite existing goal.md, progress.md, or state.env |
| Pre-flight | disk >= 100MB, lock liveness, git health, log rotation, checksum validation |
abort on [PREFLIGHT:FAIL] unless an explicit bypass exists |
| Branch setup | record ORIGIN_BRANCH, prepare ITER_BRANCH, stash and restore dirt when needed |
only when BRANCH_ISOLATION=true and AUTOCOMMIT=true |
| Main loop | external-terminator gates (wall-clock / budget / goal-drift / convergence), health check, executor run, verification, scoped auto-commit, DONE gate, signature record, state write, notify |
bounded retry, triple DONE gate (done.md + verify + placeholder-clean), atomic state.env writes, external termination by LOOP_TIMEOUT / USD_*_CAP |
| Post-loop squash | move from iteration branch to summary branch and squash if configured | only when STATUS=DONE, BRANCH_ISOLATION=true, SQUASH_ON_DONE=true |
| Footer | emit NEXUS_LOOP_STATUS and NEXUS_LOOP_SUMMARY |
non-DONE states collapse to footer CONTINUE |
Recovery Flow (recover.sh)
Usage: recover.sh [--reset-circuit] [--repin-goal] [--clear-stall] [--migrate] [LOOP_DIR]
- parse flags +
LOOP_DIR; preserve resumable fields (ORIGIN_BRANCH,ITER_BRANCH,CONTRACT_VERSION, cost) from the existingstate.env - apply targeted flags (
--reset-circuit→ delete.circuit-state;--clear-stall→ delete.action-sig.log;--repin-goal→ re-pin.goal.sha256;--migrate→ bumpCONTRACT_VERSION) - read latest iteration from
progress.md; infer recovered status from recent evidence - rebuild
state.envatomically with preserved fields, then refreshstate.env.sha256so the runner does not re-trigger recovery on resume - append a recovery note (incl. which flags ran) to
progress.md
Source-of-truth order:
progress.mdrunner.log- existing
state.env
Class → flag mapping: CIRCUIT_OPEN → --reset-circuit; CONVERGENCE_STALL/OSCILLATION_LOOP → --clear-stall (after disambiguation); GOAL_DRIFT → --repin-goal (after confirming the baseline).
Verification Check Structure (verify.sh)
- initialize
PASS=0,FAIL=0 - run each acceptance check through
run_check - print pass/fail lines
- exit
1if no checks ran or any check fails, else exit0
Effect on DONE:
PASSallowsdone.mdto promote the loop toDONEFAILforcesCONTINUE- no
verify.shmeansSKIP, which is tolerated but weaker evidence
Inter-Script Relationships
| Producer | Consumer | Contract |
|---|---|---|
bootstrap.sh |
goal.md, progress.md, state.env, optional verify.sh, run-loop.sh, notify.sh |
bootstrap initializes the loop contract |
run-loop.sh |
reads state.env, goal.md, optional verify.sh, optional notify.sh, optional done.md |
main execution loop |
run-loop.sh |
writes progress.md, runner.log, state.env, state.env.sha256, .run-loop.lock, .goal.sha256, .action-sig.log, optional .iter-timings.log; reads optional .cost-usd |
resumable execution state + stall/budget/immutability evidence |
run-loop.sh |
creates loop/iter-{name} and loop/summary-{name} |
branch isolation and final squash |
recover.sh |
reads progress.md and rewrites state.env |
evidence-based recovery |
notify.sh |
reads commit metadata and writes notification logs/audio | non-fatal notification hook |
Key Design Points
DONEis a triple gate:done.mdplus verifyPASS/SKIPplus placeholder-clean changed src (PLACEHOLDER_GREP, AP-12)- termination is enforced externally:
MAX_ITERATIONS(count),LOOP_TIMEOUT(wall clock),USD_PER_RUN_CAP/USD_PER_ITER_CAP(budget, via executor-emitted.cost-usd) - semantic-stall guard: identical change-signature over
CONVERGENCE_WINDOWiterations →CONVERGENCE_STALLand stop goal.mdis sha256-pinned at loop start; mid-run change ABORTs (GOAL_IMMUTABLE, AP-16)- retry is bounded by
RETRY_LIMIT - executor attempts, retry delays, and verification share the remaining
LOOP_TIMEOUTbudget throughrun_with_budget;portable_timeoutterminates the process group at the limit - dirty baseline uses NUL-delimited paths; scoped commits preserve pre-existing staged work and exclude loop runtime files
state.envis written atomically and protected by checksum- the runner traps shutdown signals and writes resumable state
- only
READY,CONTINUE, andDONEare valid footer statuses - pre-flight uses
100MB; iteration health uses50MB - adaptive timeout uses median of the last
5executions times2, bounded to[EXEC_TIMEOUT, EXEC_TIMEOUT x 3]
For exact script bodies, use script-templates.md.