flow.config.json (default)A web team adds email + Google login in one run
The situation: Mai's team needs a login page. Before, she prompted one agent, pasted the answer into another chat for review, and had to remember to ask for tests. Security was checked "if there was time".
$ node .orca/flow.mjs "Build a login page with email + Google sign-in"
- Planningclaudedone
Turns the sentence into scope and acceptance criteria.
PLAN.md- AC1: sign in with email + password - AC2: sign in with Google - Out of scope: password reset - Architectureclaudedone
Chooses the approach and where the code goes.
ARCHITECTURE.mdGoogle OAuth 2.0 + server session New module: src/auth/ - Detailed design ∥ UI/UXclaude × 2done · parallel
Two agents at the same time: one designs the API and data, one mocks the screen.
- Codingcodexdone
Splits the work into a task checklist you can watch tick off on the status page, then writes the code.
- Code review ∥ Security reviewclaude × 2security: fail
Code review passes. Security review finds a real problem.
SECURITY_REVIEW.mdFAIL — session token is stored in localStorage. Fix: use an httpOnly, Secure cookie. - Back to Coding (attempt 2)codexautomatic
No one has to notice. The coder gets the review as input and fixes it. Both reviews run again and pass.
- Testing → Docsopencode · claudedone
Tests are written and run, then the docs are updated.
TEST_REPORT.mdAll tests passed · AC1 ✓ · AC2 ✓
- Working login code in her worktree, ready for a pull request
- Plan, design, review, test report and docs in
.orca/artifacts/ - Token cost per step in
USAGE.md