API reference

Callable operations

Orcher's surface is deliberately small: nine operations cover the full lifecycle. RPC operations run inside your organization's database with row-level security applied as the signed-in user; server functions run over HTTPS with the same identity. Every write lands in the audit ledger.

Directives

submit_directivePostgres RPC

Capture a plain-language instruction as an immutable directive. The original text can never be edited afterwards.

Parameter	Type	Description
_t*	uuid	Organization (tenant) id.
_env*	'sandbox' \| 'production'	Target environment.
_node*	uuid \| null	Org unit the directive applies to, or null for the whole organization.
_text*	text	The instruction, 5 to 4000 characters.

Returns: uuid — the new directive id, status 'captured'.
Who may call: Owners, admins and operators. Production also requires production access and a licensed Directive Interface.
Ledger event: directive.captured

record_interpretationPostgres RPC

Attach a structured interpretation (action, systems, data classes, risk) to a captured directive. Source can be 'ai' or 'human'; each call creates a new version.

Parameter	Type	Description
_directive*	uuid	Directive id.
_source*	'ai' \| 'human'	Who produced this interpretation.
_action*	text	One imperative sentence, max 500 chars.
_systems*	text[]	Systems of record touched.
_data_classes*	text[]	Data classes involved (personal, financial, health, credentials, confidential, public).
_risk*	'low' \| 'medium' \| 'high'	Assessed risk level.
_summary*	text	Plain-English summary, max 2000 chars.
_confirm	boolean	When true, binds this version immediately (see confirm_interpretation).

Returns: integer — the new interpretation version number.
Who may call: The directive's submitter, or an org admin.
Ledger event: directive.interpreted / directive.corrected

confirm_interpretationPostgres RPC

Bind one interpretation version to the directive. This freezes the risk assessment and routes the directive to authority (or straight to authorized when the Role Identity Fabric is off).

Parameter	Type	Description
_directive*	uuid	Directive id.
_version*	integer	Interpretation version to bind.

Returns: directive_status — 'awaiting_authority' or 'authorized'.
Who may call: The directive's submitter, or an org admin.
Ledger event: directive.bound

decide_directivePostgres RPC

Approve or reject a directive that is waiting for authority. When the required number of approvals is reached, a signed, expiring authority token is issued.

Parameter	Type	Description
_directive*	uuid	Directive id.
_approve*	boolean	True to approve, false to reject.
_reason*	text	Required (min 3 chars) when rejecting.

Returns: jsonb — { status, token?, approvals?, required? }.
Who may call: A member whose role covers the directive's risk level, who is not the submitter and has not already decided. Production decisions require production access.
Ledger event: directive.approved / directive.rejected / token.issued

promote_directivePostgres RPC

Move an authorized, verified sandbox directive into production. The interpretation carries over; production authority (including the two-person rule) applies fresh.

Parameter	Type	Description
_directive*	uuid	Sandbox directive id.

Returns: uuid — the new production directive id.
Who may call: Operators and admins with production access. The directive must have a non-blocked verification verdict and must not have been promoted before.
Ledger event: directive.promoted / directive.captured_from_sandbox

Verification

record_verdictPostgres RPC

Record the Logic Scrubber's verdict for the confirmed interpretation of an authorized directive: ready, ready with conditions, or blocked.

Parameter	Type	Description
_directive*	uuid	Directive id.
_version*	integer	Must equal the directive's confirmed version.
_verdict*	'ready' \| 'ready_with_conditions' \| 'blocked'	The verdict.
_conditions*	text[]	Conditions that must hold when running.
_checked*	jsonb	Which rules were checked and their outcomes.
_summary*	text	Plain-English explanation.
_trace*	uuid \| null	Trace id of the verification run, if any.

Returns: uuid — the verdict id.
Who may call: Any member of the organization, for authorized directives only.
Ledger event: directive.verified

Tools

runToolCallserver function

Execute one action on a connected tool under an authorized directive. The call is gated: the directive must be authorized, the latest verdict non-blocked, the authority token signed and unexpired, and the outbound payload passes the data-control scan.

Parameter	Type	Description
connectorId*	uuid	Connected tool id.
directiveId*	uuid	Authorized directive id.
action*	string	Action name from the tool's catalog entry.
payload*	record	Action arguments; scanned by data controls before sending.

Returns: { status, resultSummary, toolCallId, traceId }.
Who may call: The directive's submitter or an org admin, holding a valid authority token.
Ledger event: tool.called / tool.blocked / tool.error

Ledger

verify_ledgerPostgres RPC

Re-walk the hash chain for one environment and confirm every entry links correctly to its predecessor.

Parameter	Type	Description
_t*	uuid	Organization id.
_env*	'sandbox' \| 'production'	Which chain to verify.

Returns: jsonb — { intact, count, epoch, head } or { intact: false, broken_seq }.
Who may call: Org admins and auditors.
Ledger event: —

exportEvidenceserver function

Produce a signed evidence bundle for one directive: original text, all interpretations, approvals, tokens and the ledger entries, plus a chain verification result. The bundle is HMAC-signed.

Parameter	Type	Description
directiveId*	uuid	Directive id.

Returns: { json, signature, signature_algorithm: 'HMAC-SHA256' }.
Who may call: Org admins and auditors.
Ledger event: —