Orchestra is the control layer. It decides what context is allowed, what policy applies, which route should execute, what proof is required, and whether the final answer is safe to return.
In business terms
A chatbot takes text and returns text. Orchestra takes a request and runs it through a governed execution path. Each stage is a contract — a typed envelope that can be inspected, audited and blocked. If any gate refuses, the request returns a structured blocked output with proof, never a silent failure or an improvised answer.
Policy runs twice — before and after prompt enhancement — so prompt expansion can never escalate scope.
The request journey
These are the actual envelope names used inside Orchestra. Each one is inspectable, and each gate can return a blocked output instead of letting an unsafe request continue.
Proof status taxonomy
Every output is labeled with exactly one status. Mock, fallback or dry-run results are never marked verified — the taxonomy is enforced in code, not in marketing copy.
The output is backed by a real artifact — a test run, a file, a trace — attached to its ProofBundle. This is the only status that supports a production claim.
The work was performed and reported, but the verifying artifact is not yet attached. Honest middle state — never silently upgraded.
A policy, tenant or approval gate refused the request. Blocked outputs are expected safety behavior, returned as structured envelopes with their own proof ID — never as exceptions.
Something failed mechanically. The failure is recorded with a proof ID so it can be audited and retried idempotently.
Bring one workflow. We will map it, connect it, and return proof-backed outputs within a bounded pilot.