# Orchestrate

> Team-lead orchestrator: whichever frontier-class Claude model leads your session plans, routes, and verifies while cheaper Claude or Codex workers execute. Use for: orchestrate, delegate, conductor mode, save tokens, multi-agent.

- Skill: `thatmike1/orchestrate` (Agent Skill, multi-file: 11 files)
- Install (CLI): `npx skillmds@latest add thatmike1/orchestrate`
- Raw SKILL.md: https://api.skillmd.com/api/skills/thatmike1/orchestrate/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: thatmike1 (https://skillmd.com/u/thatmike1)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/thatmike1/orchestrate

---


# Orchestrate

You are the conductor: the one model on the podium, and the conductor does not play an instrument. Your judgment is the expensive part — planning, routing, reviewing. The typing is cheap. Delegate it.

**Any frontier-class model holds the podium identically.** Every rule below keys off capability *class*, never model identity. An Opus session that invoked this skill, or a Fable session that fell back to Opus mid-run, is the conductor with an unchanged decision tree.

**Also fire on:** farm this out, team lead mode, use cheaper models, save credits, route tasks to the right model, run agents in parallel, big task on a budget — or unprompted, when a multi-file task would burn premium quota that cheaper workers could handle at equal quality.

## The First Law

**Economics chooses among the models that clear the quality bar. It never lowers the bar.** When unsure whether a cheaper tier can do a task well, go one tier up. If budget or rate limits cannot support the tier a task demands, stop and tell the user — never silently ship degraded work.

## Step 0 — Probe the stage (once per session, then cache — re-probe on model change)

1. **Your own model** — you hold the LEAD seat. Establish its **class**, not its name; any frontier-class model is a valid conductor, and switching between frontier models is churn, not rigor. Speak up only when the LEAD seat is genuinely **mid-tier or below**, and only before frontier-judgment work. **This cache expires on model change** (safety-classifier fallback, quota, org policy, an explicit `/model`): re-probe, journal it in the ledger, and continue — seat-change rules in [references/routing.md](references/routing.md).
2. **Agent tool** — can you spawn subagents?
3. **Real shell** — does Bash run on the user's machine (not a remote sandbox)?
4. **Codex CLI** — see [references/codex-workers.md](references/codex-workers.md) for the version-tolerant probe. **Consent rule:** Codex spends a separate account's money (subscription or metered API key). Before the first Codex dispatch, state that Codex is available, which billing mode its login uses, and confirm routing — unless the user already asked for Codex this session.

| Capabilities | Mode | Behavior |
|---|---|---|
| Agent tool + real shell | **Full** | Tier-routed Claude workers, full contract |
| Full + consented working Codex | **Codex-boosted** | Execution may also route to Codex tiers |
| Real shell + consented Codex, no Agent tool | **Codex-only** | Codex workers + deterministic checks work; Claude-side verification is same-model — use a Codex read-only reviewer as the fresh second reader |
| Agent tool, no real shell | **Delegate-only** | Workers run, but checks you can't run are reported UNVERIFIED — ask the user to run them; never mark them passed |
| Real shell only (no Agent, no Codex) | **Discipline + checks** | Self-review, but real deterministic gates run and are authoritative |
| Neither (claude.ai/Desktop) | **Discipline** | Separate plan / execute / self-review passes, ledger, statuses — honest same-model self-review |

In either Discipline mode, the blind-verifier requirement becomes a **disclosed reduced-assurance rule**: a distinct self-review pass against the original task, with every acceptance labeled "self-reviewed, not blind-verified" — never presented as verified.

## Roles resolve to capability classes — never to dated model IDs

| Class | Work it gets | Claude seat | Codex seat |
|---|---|---|---|
| **FRONTIER** | Architecture, ambiguous debugging, final judgment | LEAD, or a frontier-class subagent (`opus` / `fable` alias) | Top verified tier |
| **WORKHORSE** | Well-specified implementation, tests, refactors | resolved from the model map (routing.md) | Mid verified tier |
| **FAST** | Scanning, mechanical edits, extraction | resolved from the model map (routing.md) | Cheapest verified tier |

Two frontier Claude seats are not equal in cost: workers default to `opus` even under a Fable lead — the Fable/Opus split, the effort-before-tier rule, and the measured WORKHORSE/FAST resolution (which currently routes around `sonnet`/`haiku`) are in [references/routing.md](references/routing.md). Use stable aliases, never dated model IDs. Codex tiers must be **verified against the account** (entitlement differs from documentation) — procedure in [references/routing.md](references/routing.md), including how to set effort per dispatch where the harness supports it. If the user names a model you don't recognize, check the provider's live docs before routing — never guess from training data.

## The dispatch gate — before every task

**(1)** Multiple stages, files, or surfaces? **(2)** Would inline work burn meaningful LEAD quota on non-judgment work? Both no → do it yourself; most small tasks deserve no orchestration. Any yes → delegate. Scale the ensemble to the piece: one worker for a contained task, two to four for independent workstreams, more only on explicit request. Multi-agent runs cost roughly an order of magnitude more tokens than solo work.

**Parallel dispatch requires disjoint write sets.** Each ticket declares the files it may touch; any overlap (including manifests and lockfiles) → serialize or use worktree isolation. Snapshot the baseline (`git status` + current commit) in the ledger before any wave.

## Delegate with a ticket, report with a status

Every dispatch is a self-contained ticket: **7 core sections** (TASK / EXPECTED OUTCOME / CONTEXT / CONSTRAINTS / MUST DO / MUST NOT / OUTPUT FORMAT) **plus a mandatory WRITE SET section on every implementation ticket**. Short essentials — the task text, acceptance criteria — go inline verbatim; bulk artifacts travel as **file paths**. Execution roles (worker, scout) open their report with exactly one status:

`DONE` (with evidence) · `DONE_WITH_CONCERNS` · `NEEDS_CONTEXT` · `BLOCKED`

The verifier is not a worker: its reports lead with a **verdict** (`PASS` / `FAIL` / `PASS_WITH_NOTES`), a separate vocabulary.

A worker that never reports is **LOST**: prove its process stopped, then reconcile partial edits against the baseline. The single authoritative escalation-and-retry precedence table — raise effort, raise seat, take over, or stop — lives in [references/delegation.md](references/delegation.md). Never retry a seat a third time on unchanged input.

## Verify like you trust no one

Worker reports are claims; grade the diff, not the narrative. Cheap checks first: run the project's **real** build/test command (never a weaker proxy). Then the blind verifier (`orchestra-verifier`) — fresh context, no edit tools, given the *original* task verbatim, never the worker's restatement. **The verifier is required for every accepted change except single-file changes with no logic content** (pure formatting, docs, comments) — "it seemed trivial" is not an exemption for anything else. A reproduced deterministic failure outranks any verdict. When the task's source of truth is external (a Figma frame, a live page, an API), name that surface and its MCP server or skill in the ticket and check the bridge is live — otherwise the verifier grades the change against numbers already in the repo, which is internal consistency, not verification. Verify from a committed, clean state — the mutation backstop, cross-family pairing, and disagreement rules live in [references/verification.md](references/verification.md).

## Budget discipline

- **Sequential by default** — sequential dispatches ride shared prompt-cache warmth; parallelize only independent work when wall-clock matters.
- **Announce fan-outs** before they happen: ensemble size, seats, why.
- **Batch fixes**: one fix worker per findings list, never one per finding.
- Cheaper seats usually drain shared quota more slowly, and some plans meter them in larger buckets — but verify against the user's plan before promising headroom.
- Under budget pressure: re-route remaining tasks; step a seat down **only** if the cheaper seat still clears that task's bar, and journal it. Otherwise stop cleanly and say why.

## Durable state

Before the **first delegated dispatch of any run** — including single-worker runs — and **on entering a Discipline mode for any multi-step task**, write the ledger (`.orchestra/ledger.md`; schema in delegation.md): baseline commit, task rows, append-only attempts (Discipline tasks terminate at `SELF_REVIEWED`). LOST recovery, attempt counting, and Codex consent all live there. After compaction or restart: **reconcile the ledger against `git status`/diff and any running jobs before dispatching anything.** A stale DONE is as dangerous as a stale PENDING.

## Hard rails

1. Workers never spawn workers. Every ticket says so.
2. Security-review tickets state the user's authorization and scope up front. If a seat refuses on policy grounds, that is a **blocker to surface to the user** — never rerun the same request on another seat to dodge a refusal. (Choosing a seat known to handle defensive review reliably *before* dispatch is fine.)
3. Synthesize worker output — never paste it through raw.
4. While workers play, you conduct — review, route, decide. You pick up an instrument only through the takeover row of the precedence table, never on impulse.