Skip to main content
Yellowhammer runs its orchestration on your Mac, using Orca Worktrees and your authenticated agent CLIs. Local execution describes where tools run; those tools and integrations still communicate with their external services.
Planned relationship diagram
Local execution boundaries

Show Yellowhammer, Orca worktrees, agent CLIs, repositories, and credentials on the user's Mac.

Planned diagram: local tools and credentials stay on the Mac while GitHub receives review pull requests.

​
Where execution happens

The app is a control surface for local configuration, diagnostics, and recorded activity. The embedded yh engine runs short-lived Acts for one Project at a time. launchd owns the schedule, so an unattended Night does not depend on keeping the app open. Orca ADE provides Worktrees for agent work. The configured agent CLI writes code and uses its own authentication and model access. Yellowhammer records loop state in the Project’s local Journal and shows those records in the Pulse and Inspector.

​
Credentials and external services

You connect Linear and GitHub and authenticate your chosen agent CLIs. Yellowhammer uses the configured connections for board activity and publication, while agent CLIs use their own credentials and subscriptions. Yellowhammer stores its integration credentials in the macOS login Keychain. Linear receives issues, comments, questions, and reports. GitHub receives pushed branches and pull requests. An agent CLI can send code or prompts to its model provider according to that tool’s configuration and service. Running the coordinator locally does not mean all data stays on the Mac. Use connection setup and Agent CLI setup to verify each dependency before an unattended Night. A successful board connection does not establish that the agent CLI can authenticate or that GitHub publication will succeed.

​
Permission boundaries

Protected Paths compares a Work Card’s Declared Scope with the repository’s configured protected paths before dispatch. It is a scoping check, not a sandbox: nothing in that check prevents an already dispatched agent from touching a protected path. Worker passes are not sandboxed by Yellowhammer. Prompt boundaries and CLI-specific permission rules vary by adapter. Read-only pass containment also varies by CLI. A Probe’s state-containment finding measures its read-only architect pass, not the worker configuration; a passing result is not evidence that worker filesystem and network access are contained. For an unexpected Keychain prompt caused by an agent pass, choose Deny rather than Always Allow. The engine detects attributable Keychain prompts and ends the pass, but ending it does not dismiss the dialog. macOS privacy prompts are not covered by that detection.

​
Privacy prompt detection

TBD — not yet implemented. Automatic detection of macOS privacy (TCC) prompts is not implemented. The current prompt detector handles Keychain prompts only.

​
Next steps

Settings · Set limits and Protected Paths