Docs — Orchard

Quickstart →Point a remote and push in under a minute. Fleet CI →Run Actions on your own runners. From GitHub →Mirror or move a repo, no rewrite.

Quickstart

From zero to a pushed repo running CI on the fleet — three commands, no migration.

1 · Sign in

Human access is number-match AuthGate SSO. Pick your workspace (AXE or IMI), approve the number on your phone, and you're in. No password to phish.

2 · Point a remote at Orchard

# any existing repo — no rewrite, no migration
$ git remote add orchard [email protected]:memjar/repo.git
$ git push orchard main

3 · Watch it grow

Push-protection scans the diff, CI queues on a fleet runner, and your models and datasets live in the same forge — versioned right next to the code that trains them.

TipPrefer HTTPS? Swap the remote for https://orchard.onl/memjar/repo.git and authenticate with a scoped personal access token.

Core concepts

Orchard is a soft-fork forge that runs as our binary on our hardware. Same git, same API you know — a perimeter you own.

Concept	What it means on Orchard
Perimeter	Your source, CI, and artifacts never leave infrastructure you control.
GitHub-compatible	The git protocol, REST API surface, and Actions workflow YAML you already use.
Fleet-native CI	Jobs run on our own runners — no metered minutes, no third-party build farm.
AI-native	Models, datasets, and agents are first-class repositories, not attachments.
AuthGate	Number-match SSO identity provider gating every human login.

Authentication & SSO

People sign in with AuthGate; machines use scoped tokens or SSH keys.

Number-match SSO

Click Sign in, choose a workspace tile (AXE, IMI, or DEV), and confirm the displayed number on your registered device. AuthGate is a full OIDC provider — the same identity powers every gated Orchard surface.

SSH keys for git

# add your public key under Settings → SSH / GPG keys
$ ssh-keygen -t ed25519 -C "you@axe"
$ pbcopy < ~/.ssh/id_ed25519.pub
$ ssh -T [email protected]   # → "Hi you! You've authenticated…"

NoteAutomation (CI, agents, bots) should never use a human SSO session. Mint a scoped PAT per job and store it in the CI secret store.

Repositories

Create fresh, import from anywhere, or set up a live pull-mirror.

New repo — + → New Repository, pick the owner (your user or an org), set visibility. Private is the default.
Import — + → New Migration pulls an external repo (GitHub, GitLab, plain git) including issues and PRs.
Mirror — a pull-mirror re-syncs on a schedule; crown-jewel repos are mirrored into the axe-vault org as a sovereign fallback.

Git over HTTPS & SSH

# clone over HTTPS (PAT) …
$ git clone https://orchard.onl/memjar/repo.git
# … or SSH
$ git clone [email protected]:memjar/repo.git
$ cd repo && git checkout -b feature
$ git push -u orchard feature

Two hostnames, one forge: orchard.onl is the public canonical door; orchard.axe.onl is the AuthGate-gated interior. Both reach the same repositories.

Import & mirror

Bring a repo in once, or keep it continuously in sync.

Mode	Behaviour	Best for
Migration	One-time copy of code + issues + PRs.	Moving a project onto Orchard.
Pull-mirror	Re-fetches upstream on a schedule.	Sovereign backups of GitHub repos.
Push-mirror	Forwards your pushes to a downstream remote.	Keeping an external copy warm.

TipPull-mirrors force-update on sync, so branch protection is not applied to them — that's expected and by design.

Pull requests & review

The review flow you know — plus an AI reviewer that reads every PR.

Open a PR against the protected branch. On open/sync, Orchard runs its checks and posts status back to the PR head:

Secret-scan — blocks the merge if a credential is found in the diff.
AI review — the orchard-ai reviewer posts a risk-scored comment (e.g. risk 5/5 · must-not-merge) in about one model call.
Required checks — merge stays disabled until every required status is green.

Branch protection

New repos are provisioned with standard policy automatically — no per-repo wiring.

On non-mirror default branches Orchard makes orchard/secret-scan a required status check, so a leak blocks merge (GitHub push-protection parity). The org provisioner applies this within the hour to every new memjar and axe-vault repo; the bot and mirror accounts stay push-whitelisted so automation still commits.

ExcludedIMI surfaces are denylisted from auto-provisioning by name and pattern.

Fleet-native CI

Actions-compatible workflows that run on our own runners — no metered minutes.

Drop a workflow at .orchard/workflows/ (or the familiar .gitea/ / .github/ path). Jobs are picked up by fleet runners and execute in-perimeter; artifacts never touch an external build farm.

name: build
on: [push]
jobs:
  test:
    runs-on: fleet
    steps:
      - uses: actions/checkout@v4
      - run: cargo build --release
      - run: cargo test

Label a job runs-on: fleet to pin it to fleet hardware. Runner pools map to nodes like jl2 and axeserver.

Secret scanning & push protection

Every added diff line is scanned before it can merge; findings are masked.

Orchard ships gitleaks-style rules — AWS keys, GitHub/GitLab/Slack/Stripe/Google/OpenAI/Anthropic tokens, private-key blocks, JWTs, and generic secret=… assignments — plus an entropy backstop and a placeholder filter (changeme / example don't trip). Only added lines are scanned, and every finding is masked (AKIA…MPLE) before it's written back.

pull_request → posts a masked findings comment and sets the orchard/secret-scan status.
push → sets the same status on the pushed sha.
No model call, no external network — pure regex + entropy.

Codespaces

Ephemeral, browser-based dev environments — cloned, reachable, reaped.

Spawn a codespace for any repo and it comes up at https://<id>.cs.orchard.axe.onl/ running code-server with the repo cloned. Access is an unguessable id behind a wildcard TLS cert with a TTL reap. Delete it and the container is torn down cleanly.

$ curl -X POST https://orchard.axe.onl/-/codespace \
     -d '{"repo":"memjar/orchard"}'
# → https://<id>.cs.orchard.axe.onl/  (code-server, repo cloned)

Semantic code search

Ask in plain language; get ranked, meaning-aware hits.

The Brain-backed /-/search surface understands intent, not just tokens. A query like “where do we verify the OIDC issuer” returns the right file even when those exact words never appear in it.

Provenance & audit

A graph of what produced what — repos, artifacts, and the actions between them.

The provenance surface at /-/graph renders the lineage across an org: which repos, which artifacts, which actions connect them. Governance for models and datasets that need a paper trail.

Models & datasets

Weights and corpora are repositories — versioned, reviewed, and provenance-tracked.

Model checkpoints, tokenizers, and training corpora live in the same forge as the code that trains them. Tag releases, diff configs, gate merges — the Cassius foundational family and its datasets are managed exactly like source.

Large files & LFS

$ git lfs install
$ git lfs track "*.safetensors" "*.gguf"
$ git add .gitattributes model.safetensors
$ git commit -m "add checkpoint" && git push orchard main

LFS keeps large binaries out of the git history while versioning them alongside it. Storage can offload to backing object stores while staying addressable in-perimeter.

Agents & pipelines

Orchestration graphs and agent definitions, versioned and run on the fleet.

Agent definitions and pipeline graphs are stored as repositories and executed by fleet-native CI. The same review, protection, and provenance guarantees that cover source cover the agents that act on it.

Organizations & teams

Workspaces with membership gated by AuthGate and access scoped by team.

Org	Purpose
`memjar`	R&D — the canonical home for models, engines, and infra.
`The-Answer-Ai`	Product — the handoff target for shipped surfaces.
`axe-vault`	Sovereign pull-mirrors of crown-jewel repos.

Tokens & scopes

Least-privilege by default — mint the narrowest token the job needs.

Generate a personal access token under Settings → Applications with only the scopes required, then store it in the CI secret store — never in the repo.

NeverDon't commit a token, and don't store a secret verbatim in a cookie. Push-protection will block obvious leaks, but scoping is your first line of defence.

API reference

A GitHub-compatible REST surface — most existing clients and CI just work.

$ curl -H "Authorization: token $ORCHARD_PAT" \
     https://orchard.onl/api/v1/repos/memjar/orchard
# list your repos
$ curl -H "Authorization: token $ORCHARD_PAT" \
     https://orchard.onl/api/v1/user/repos

The API lives under /api/v1. Point tooling that speaks the GitHub/Gitea API at that base URL with a scoped token.

Migrate from GitHub

Move a repo, keep a mirror, or just add a remote — pick your commitment level.

Add a remote — the lowest-risk path; push to Orchard while GitHub stays put.
Pull-mirror — Orchard re-syncs from GitHub on a schedule; a sovereign backup.
Full migration — + → New Migration brings code, issues, and PRs across in one pass.

Zero rewriteYour history, branches, and tags come across intact. Nothing about your local git changes except the remote URL.

Security & privacy

Private by construction: our binary, our keys, your data.

Perimeter — source, CI, and artifacts stay on infrastructure you control.
TLS everywhere — every public endpoint terminates valid certificates; production TLS is never disabled.
SSO + isolation — number-match AuthGate, tenant isolation, and audit built in.
Offline-capable — the forge runs air-gapped when it has to.

Troubleshooting & FAQ

Push rejected by `orchard/secret-scan`

The diff contains a credential. Remove it, rewrite the offending commit, and re-push. Placeholders like example won't trip the scanner — real-looking keys will.

Merge button is disabled

A required status check hasn't gone green. Open the PR's checks tab to see which one is pending or failing.

SSH says `permission denied`

Confirm your public key is added under Settings → SSH keys and test with ssh -T [email protected].

Which host do I use?

orchard.onl for public/canonical access, orchard.axe.onl for the AuthGate-gated interior. Same repos behind both.

Support

Stuck, or need access? Here's how to reach a human.

Request access →Register and an admin approves. Open an issue →File it on the relevant repo. Explore Orchard →See what's already growing.

Orchard — where your code grows. Own the binary. Own the pipeline. Own the data.

Ship code, CI, and models — on hardware you own.