Config keys

Every setting is a key in a config.toml (layers). Set one by hand or with orrery config set <dotted.key> <value>; orrery config explain <dotted.key> says where its value came from. A misspelt key in a checked table fails at load, naming the file, the line and the keys that exist.

Secrets are written "$VAR" (the file holds only the variable's name) or, in the user layer only, as the literal value.

#Top level

#[tools]

#[roles] and [agents.<name>]

[agents.summariser]
prompt = "Summarise the conversation so the work can continue."
model = "claude-haiku-5-5"

[roles]
summariser = "summariser"

#[keys]

#[providers]

#[profile.<name>] and [profiles]

#[permissions]

#[budget]

Limits for one run of the main agent. Unset means no limit.

#[limits]

Bounds on what extensions may do (decision 0077). Each has a default; a managed layer can only lower one. A value that is not a positive whole number fails at start and names its file and line.

An unknown key, or an unknown phase, fails at start and lists the valid ones.

Limits of componentBytes, dataBytes and dataUpdatesPerSec:

• A structure over componentBytes is refused when it is declared or shown, and the refusal names the size and the key. Nothing is drawn from it.
• A data update that takes an instance over dataBytes is refused. The last good data stays drawn.
• Updates over dataUpdatesPerSec are coalesced: the last value wins at the next allowed moment. Nothing is dropped, but a fast-changing value is shown late, not in real time.
• Each of the three is a positive whole number. 0 fails at start, naming the file and line. 0 would mean no structure, no data or no updates ever, which is never what is meant.
• A managed layer can lower each value and cannot raise it. The user's value wins only below the managed one.
• The sizes are of the serialized JSON, so a few bytes of formatting count against the limit.
• There is no upper bound checked here. A very large dataBytes is allowed, and every accepted update is written to the session log, so a large value grows the log faster.

#[retry]

#[prices]

A price for a model nothing prices, or an override, in micro-USD per million tokens:

[prices."gemini-3-flash-preview"]
inputPerMillion = 500000      # $0.50 / MTok
outputPerMillion = 3000000    # $3.00 / MTok
cachedPerMillion = 50000      # cache hits; otherwise billed as input

#[windows]

How many tokens a model holds: where the harness compacts, and what the footer's context percentage is measured against. An exact id or a prefix*, in any layer:

[windows."claude-haiku-5-5"]
tokens = 200000               # compact at 200K instead of the model's 1M

Without one, a model's window is the one the provider runs it at (Ollama's contextLength), else what the provider's model list reports (Anthropic's max_input_tokens), else what its extension declares, else the provider's one default. A model that comes in two sizes counts at the one Orrery's requests get: Claude Sonnet 4 and 4.5 reach 1M only behind a beta header Orrery does not send, so they count as 200K. A value that is not a positive whole number fails at load, naming the key. orrery config explain 'windows."<model>".tokens' says where a window came from.

#Agents and sub-agents

#[extensions.<id>]

Declaring the table loads the extension; its keys are settings that extension reads. For example [extensions.theme] with default = "dark". The older top-level list, extensions = ["theme"], still works and says what to write instead.

Limits of resident:

• A resident extension keeps one process for the session. It costs memory even when idle (about 1 to 16 MB, by language).
• A parked extension's surfaces stop updating without saying so. Resident keeps them current.
• An extension that holds a subscription or a watch is never parked, resident or not.

#[mcp_servers.<name>]

#[mcp]

#[skills.<name>]

#[trust]

#[registry]

Usually in the managed layer.

#[ui]

Limits of the chrome keys:

• A placement moves only a surface that exists. An id nothing has placed does nothing, and says nothing.
• input, consent and trust cannot be shown, hidden or moved from config. The host draws them alone (decision 0087); a key naming one fails at start.
• Only Tier 1 elements take show. Any other name fails at start and lists the ones that do.
• Every placed surface is labelled with its owner on screen. Config can move it, but cannot remove that label.

#[views."<event>"]

Where the surface an event produces goes. Each event kind has one binding; this table moves it (decision 0088 §7).

Limits of [views]:

• Only the placement can be set here. Which surface an event shows, and when, stays in the code that bound it.
• The event name is not checked at load. A misspelt name matches no event, so its binding keeps the default placement.
• A placement written here is still subject to ui(<placement>) rules: a deny wins.

#[node] and [session]

For the node and the sessions it runs.

#[cloud] and [handoff]