Orchestrata Ultimate › Research › Host inventories

Host inventories — services, hooks and skills (2026-10-22)


Question	What actually runs on this host, from which commit? Which hooks fire in a Claude session, and which skills load?
Method	Three read-only censuses, 2026-10-22 23:30–23:58. Services: every unit file under `~/.config/systemd/user` was read, with deploy identity checks. Hooks: every registration file was read, every script was checked with `test -e`, and Python hooks were read through the deployed AST toolkit. Skills: an Explore agent counted the skills per folder
Status	Recorded. The defects are listed below. Fixes are not dispatched yet, except the three restored hooks (see hidden spawners)

The full per-unit, per-hook and per-skill reference pages are generated separately:

This page is the summary and the findings.

1. Services

Deployments

Deployment	Commit	Current?
`/opt/orchestrata`	`4ac0db570`	It was `origin/master` at measurement time. `master` has since moved to `a4cbc2bdf`, so a redeploy is owed
`/opt/orchestrata-tools`	`7309a3488`	At census time it contained `origin/master`, but `7309a3488` is on no remote branch (unpushed, from `wt-TOOLS-FAST`)
`/opt/codetools`	`b518f88a` at census, now `a5c419f5`	Yes. `ct-install 74`, then `ct-install 75`
`/opt/hermes`	`b1b66a6`	It equals local master, which is 10 commits ahead of GitLab `origin/master` (unpushed)
`/opt/pi-worker`	`238d899c3300`	Yes. `pi-task verify` reported VERIFIED
orchestrata plugin and `~/.claude`	`4ac0db570` at census, now `a4cbc2bdf`	Yes. Redeployed 2026-10-23 00:00

systemd user units

Orchestrata units (prod, /opt/orchestrata). These are kernel, gateway, ast-live-sync, conversation-consumer, bot, canvas and miniircd. All are disabled, which is DeepChat's 2026-10-21 shutdown (see DeepChat review). One oddity: orchestrata-conversation-consumer is disabled but active.
Timers still on. Three are enabled: kg-retention (Sundays 04:00), orchgraph-backup (daily 03:00, keeps 14 snapshots) and history-mining (quarterly). infra-drift (hourly) is off.
Outside orchestrata. hermes-gateway runs from a separate venv under ~/.hermes, not from /opt/hermes. Two GitLab runners are active, one user and one system. Five HTTP MCP servers (architecture, dev-tools, knowledge-memory, openmandriva, task) are disabled, and none of them is registered in Claude's MCP config. memory-monitor and aw-proxy are disabled; performance-monitor.timer (every 15 min) is on. There are seven older pre-orchestrata units, all already off. weston is disabled and must stay disabled: X11 only.

Incus fleets

Project	Autostart	Role
`default` (prod)	true	The orchgraph Memgraph HA cluster (3 coordinators, 2 data nodes), plus Prometheus and Redis
`orchestrata-test`	false since 2026-10-21	The test tier `run_tests.py` uses (`env/test.env`): app, Memgraph, the HA pair, Prolog, Redis, and the `rh-*` cluster
`orchestrata-dev`	false	The dev tier: Memgraph, Prolog, Redis
`orchestrata`	unset	Infrastructure containers. `claude-orchestrata` and `knowledge-wiki` are running; `gitlab-server` and seven `codetools-`/`ct-` test leftovers are stopped

MCP servers Claude launches (stdio)

orchestrata: broken. orchestrata-mcp refuses with GATEWAY_TOKEN is not set. See the gateway token analysis.
codetools. Sessions started before ct-install 74 keep the old release (6b4babfeaac2e008) until they restart.
hermes, perplexity. Working.

Stale documentation

The orchestrata-provision skill's probes 2 and 3 check ~/prod/orchestrata-ultimate. That directory no longer exists; prod is /opt/orchestrata.

2. Hooks

Source	Hook commands	Loads in a `$HOME` session?
`~/.claude/settings.json`	2	yes
`~/.claude/settings.local.json`	3	yes
orchestrata plugin 1.5.0	65	yes
tmux-status 1.2.0	11	yes
turn-navigator 1.1.3	2	yes
codetools plugin 0.1.0	5	only when the session's project is `~/workspace` (scope local)
`wt-MAP-PRECOMMIT/.claude/settings.json`	31	only in sessions rooted in that worktree
Total	119	83 live in a `$HOME` session: 30 can block, 1 asks, 52 advisory

Two more files look like hook sources but are never loaded:

~/.claude/settings.hooks.json, with 34 hooks. Claude Code never reads that filename.
the repo's claude/settings.json, with 12 hooks. The installer does not deploy it.

The five hooks that shape a session most

intercept_bash.py (every Bash call). It blocks rm, sed -i, write_text/open('w'), and any redirect or tee to code or doc files outside /tmp/claude-*. It matches raw text, so a commit message or a grep pattern can trip it.
intercept_write.py. It refuses a Write over an existing file, which forces Edit. It also refuses any path containing context.json, context.md or .claude/plans/.
autoformat.py. It runs black and ruff --fix on every .py after each write, and reformats every .json. The file on disk then differs from what was written.
task_context_hook.py. It denies Agent briefs that miss the required fields, and otherwise rewrites them with methodology and module contracts. Uncached, a .py edit costs about 8.7 s of injected context.
The orchestrata dispatch guards. Once a session touches an orchestrata tree, every Bash call passes 9 deny guards (AST toolkit only, no xdist, observed tests, proportionate scope, single gate entrypoint, and others). Four Stop guards also force the turn to continue on hedging, "pre-existing" excuses or offers instead of fixes. The audit log showed about 143 runs per guard in about 12 minutes.

Defects worth knowing

#	Defect	Effect
D1	`codemap_refresh.sh`, `precommit_gate_subagent.sh` and `dispatch_ledger.py` are in no repo	The next config deploy deletes them, because its rsync uses `--delete`. This happened at 00:00 on 2026-10-23, and the hooks were restored from backup
D2	`~/.claude/settings.json` is not generated from the repo's `claude/settings.json`	The repo file is not the source of truth it looks like
D3	`infra_check.py` reads `user_message`, but UserPromptSubmit sends `prompt`	It never fires
D4–D6	Four codetools plugin hooks have problems. `block_except_pass.py` and `error_gate.py` read top-level fields instead of `tool_input`. The Stop ADR trigger emits `decision: allow`, which Stop ignores. `coverage_gate.py` has no `stop_hook_active` guard	Three of them do nothing; the coverage gate can loop
D7	The decision-to-ADR reminder is registered twice	It is injected twice
D8	`project_context_refresh.py` launches `inject-codebase-map.sh` in the background while the dispatch or repo copy also runs it	Two writers race on `docs/CODEBASE_MAP*.md`
D9	`$HOME` is a git repo with a `pyproject.toml`	Every `$HOME` session indexes `$HOME` and runs `ast-sync` on it
D11	10 plugin commands run the `~/.claude` copies, not `${CLAUDE_PLUGIN_ROOT}`	The plugin breaks on a machine without the separate config deploy
D13	Two PostToolUse hooks exit 2 "to block"	A PostToolUse exit cannot undo a write that already happened
D14	`intercept_*` use the deprecated top-level `decision: block` form, and `intercept_bash` matches raw text	Deprecated output form. The raw-text match blocks `git rm`, `docker rm` and write patterns inside quoted text
D17	`boot_health_check.sh` runs Arch/CachyOS checks (`pacman`, AUR)	Those checks cannot run on this OpenMandriva host
D21	The `agent-mail` and `kimi-session` commands the hooks recommend	Neither is on `PATH`
D29	Each Bash call starts about 15 hook commands	Steady process fan-out on every call

No hook script is missing (all 119 pass test -e), and no live hook points into a development checkout.

3. Skills

What loads where:

A session started in ~ loads 11 user skills, 20 synced claude.ai skills, and the plugin skills: orchestrata 10, tmux-status 1, turn-navigator 1, engineering 10, design 7, productivity 4, cowork 2.
The codetools plugin's 7 skills load only in sessions whose project is ~/workspace.
wt-MAP-PRECOMMIT/.claude/skills (7) load only in that worktree. .opencode/skills (3) never load in Claude Code.

Gaps found:

kimi-webbridge is dead: the whole ~/.kimi-webbridge directory is missing.
agent-messaging points at kimi-session and agent-mail, which are not on PATH.
orchestrata-provision targets a prod path that no longer exists (see above).
ct, gh, review-tools and test-gen are missing from PATH for the skills and commands that call them.
The test-isolation fixtures still use the old <PREFIX>_NEO4J_URI names. The session skill still calls its sync "Neo4j".

Duplicates. Ten skills are byte-identical in ~/.claude/skills and in the orchestrata plugin, so every session lists both copies. decision has a third copy in the repo. 13 of DeepChat's 51 skill names collide with Claude Code skill names.

Recommendations

None of these is a ruling.

Commit the three hand-installed hooks into the repo's claude/hooks/, with their registrations (D1). Until then, check for them after every config deploy.
Make the plugin self-contained (D11), and generate ~/.claude/settings.json from one source (D2). Then remove settings.hooks.json.
Fix the payload field names in infra_check.py and the codetools hooks (D3, D4), and add a stop_hook_active guard to coverage_gate.py (D6).
Drop one of the duplicate ADR-reminder registrations (D7), and one of the duplicated skill copies.
Update the provision skill's prod path.