Tiered Orchestration

One orchestrator (T1) runs a campaign through lanes it launches as real Claude sessions; each lane (T2) runs its own gates and fans out workers (T3). State lives in files, every question reaches the operator through T1's one session, and nothing is trusted that was not re-derived from git/gh. Every rule here was bought by an incident; the incidents are in reference/measured-lessons.md — read that when a rule looks excessive, not before starting.

The three tiers

T2 is per initiative: it retains 25–50k tokens, and a five-initiative batch degrades long before it dies. Lanes are real sessions because in-process subagents cannot nest — a T2-as-subagent loses its T3 fan-out and does everything in one context.

File-durable state

• <campaign>/ledger.md — write-ahead: INTENT before every irreversible action, OUTCOME after. Status is re-derived from gh pr view --json state,mergeCommit and git before it is trusted, never attributed from a report.
• <campaign>/briefs/<lane>.md — goal, exact gate commands, exit table (each row names the lane, the producer and the grep proving it exists; an empty row = refuse to launch), park points, budget.
• <campaign>/gate-manifests/<lane>.* — the pinned test world (immutable-gates).
• beads (bd) — the dependency DAG; a park is a bead before the lane that parked it returns.
• <campaign>/heartbeat/ — ACTIVE (T1-owned), <lane>.log real state, <lane>.liveness declared job logs, <lane>.session id, STALL-<lane> flags.

Successor test: a fresh T1 with no chat history resumes from these files alone. Campaign dirs are gitignored; a permanent artifact never cites a path inside one.

Lanes: launch · route · watch · retire

scripts/lanes.sh (run with no args for help). One lane = one named Claude session forge-<lane> in a detached tmux session, cwd the main checkout, its own worktree ~/forge-<lane>.

A lane's messages arrive in T1's context on their own; T1 never polls. lanes.sh peek and tmux attach are for diagnosis and for attended sessions (an operator narrating in the lane's own window), never for learning whether a lane is done. A lane that has sent OUTCOME but whose merge T1 cannot re-derive is not done.

Guard rails — each enforced somewhere, each bought by an incident

Park protocol

Pre-authorise the known park points at kickoff (ADR amendments, judgement content, new dependencies, spend ceilings). A park is: the artifact → a bead → SendMessage to T1 with first line PARK <lane>: <question, artifact path, default if unanswered> → end the turn. The default is what the lane will do if it runs out of non-dependent work before a ruling arrives: a pre-authorised park may proceed on its default, anything else waits. An unforeseen ask parks the same way while non-dependent work continues. Batch rulings: one operator sitting per lane beat every relay round-trip measured.

Red flags — STOP

• "I'll peek the pane to see if it finished" → the events Monitor is armed; a finished lane sends OUTCOME, an idle one shows up as LANE_IDLE.
• "I'll type the ruling into the lane's terminal" → SendMessage.
• "The lane will de-register / clean up its own session" → lanes.sh kill.
• "The pane log is fresh, so it's alive" → an idle TUI redraws; only the heartbeat counts.
• "STALL flag → reclaim the lock" → the 3-signal check first.
• A coordination rule that lives only in prose → it is decoration; put it in a script, a hook or a file, or delete it.

T1 tools — scripts/, and every path an argument

Each was rebuilt by hand in a gitignored campaign dir for three campaigns running. They live here now so the next T1 inherits them, and none of them resolves an input from its own location: a tool that does answers a different question in each checkout (§15.148).

See also

• immutable-gates — the pinning and verification contract T2 executes.
• adversarial-containment-review — the review brief T3 reviewers receive.
• reference/measured-lessons.md — the incidents and measurements behind every rule, wave 5 → forge 1.0 M1, and the mechanisms they retired.