Everything here is infrastructure the runtime already carries: not code you write, and not per-service. This page is the map. Each entry links to the page that owns it in full.
Click a node in the capability map to expand it, and click a capability to open its page.
JSON or pretty output, five levels, per-crate control through RUST_LOG. Every request carries an x-request-id — sent by you or generated — that appears in the logs and comes back on the response.
Request counts and error rates, latency histograms, engine and trace-queue gauges, breaker state, rate-limit rejections. Served on a dedicated bind address; every series is named in the Metrics Reference.
/healthz for liveness, /readyz for readiness, /health for per-component state. /health is two-tier: anonymous callers see coarse status, admin callers see the detail.
Four levels, outside in: channel, connector, HTTP client, health check. The channel timeout applies on every ingress — sync, /async, Kafka and channel_call — with per-ingress ceilings that clamp it.
HTTP connectors only: exponential backoff capped at 60 s, on retryable failures of idempotent methods. Nothing else is re-driven, because a timed-out INSERT may already have applied.
Keys compared in constant time, storable as sha256: digests, several at once so rotation needs no downtime. Missing admin auth is a startup error in production, not a warning.
Per channel: api_key, hmac over a templated signing string (raw body by default; provider presets) verified before parsing, or jwt with the verified claims exposed to channel logic and the workflow. OIDC flows and mTLS termination stay out of scope — put a gateway in front for those.
env:// and vault:// references resolved at load, never stored inline. Secret fields are masked in API reads, and the stored config is AES-256-GCM encrypted at rest when storage.connector_encryption_key is set (plaintext by default).
SSRF protection blocks private and internal addresses unless a connector opts in. Operation gates make a connector read-only, delete-proof, or anything between.
TLS termination in-process or at a proxy; CSP, X-Frame-Options, HSTS and the rest set by default; origin checks enforced server-side rather than trusted from the browser.
Token bucket with burst, per channel, keyed by a JSONLogic expression over the request — so a limit can be per API key, per tenant, or per IP. A platform-wide limit sits above it.
N replicas as one logical system: rate limits, deduplication and caches shared through Redis, config changes propagated by epoch, scheduled jobs leased to one node.
One executable with an embedded database and no runtime to install beside it. Homebrew, shell and PowerShell installers, prebuilt multi-platform binaries, or from source.
validate-config, test-connectivity and preflight answer “will this instance come up, reach its backends, and load what is already stored” before the deploy, not after.
Parsing, mapping, filtering, validation and logging; HTTP calls; the portable data dialect, raw SQL and MongoDB; cache read and write; Kafka publish; transactional email; object-storage presigning; hashing, HMAC and JWT sign/verify; model inference.
REST with route patterns and path parameters, plain HTTP by channel name, Kafka topics, and cron schedules — each of them sync or async where the transport allows, except cron, which is always async and has no caller at all.
Custom task functions as sandboxed WebAssembly components: a pure JSON → JSON transformation, uploaded and activated like any other definition, promoted in packages, synced across a cluster. The sandbox imports nothing — no filesystem, clock, network or secrets.
ONNX models held in object storage and admitted — fetched, digest-checked, parsed and probed — before a version may serve. A manifest’s JSONLogic adapters shape the message into tensors and read the outputs back, so calling one stays a declarative task. Off by default.
Note
Orion extends by configuration, and by pure computation. A plugin is the one way to add a task function at runtime and a model the one way to add a learned one. Both only compute; everything with I/O stays a connector or a service of your own. What you can extend states the boundary exactly.
Activating a version swaps the engine atomically. Requests already in flight finish on the engine they started on. No restart, no dropped connection, no deploy window.
Full CRUD over channels, workflows, connectors, plugins, models and packages, plus lifecycle transitions, engine control, and dependency inspection. Everything the console and the CLI do, they do through it.
Lint a workflow file, dry-run it against sample input with stubbed connectors, and keep *.case.json regression suites next to the JSON. None of it needs a running server.
export, lint, plan, apply and diff move a named, versioned unit between instances. Applied versions are content-immutable, and receipts record exactly what shipped.