What is cto-orchestrator?

A conductor for a structured CTO review process. It searches several areas of a project, checks proposed findings with an opposing review, builds a gated backlog, and applies only items allowed by the project's rules.

Use it to inspect project health, find issues, verify them, create a prioritized backlog, and apply approved changes in Git worktrees.

It turns broad project review into ordered stages with checks before changes are made. It also prevents items requiring human approval from being applied automatically.

How JosephOIbrahim/Synapse configures Claude Code

Reuse

Borrowing it

Nothing to install: this file belongs to JosephOIbrahim/Synapse. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/JosephOIbrahim/Synapse/master/.claude/agents/cto-orchestrator.md

Clone the repo

git clone --depth 1 https://github.com/JosephOIbrahim/Synapse

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/agents/josephoibrahim/synapse/cto-orchestrator/github.svg)](https://agentmods.dev/agents/josephoibrahim/synapse/cto-orchestrator)

Your own site

<a href="https://agentmods.dev/agents/josephoibrahim/synapse/cto-orchestrator"><img src="https://agentmods.dev/badge/agents/josephoibrahim/synapse/cto-orchestrator/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/agents/josephoibrahim/synapse/cto-orchestrator"><img src="https://agentmods.dev/badge/agents/josephoibrahim/synapse/cto-orchestrator.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 149 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 589 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00149	$0.00589
Opus 5.5	$0.00060	$0.00236
Sonnet 5.5	$0.00030	$0.00118
Haiku 4.5	$0.00015	$0.00059

Measured 1mo ago against content hash 36a53919a773, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

cto-orchestrator scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

5. Bridge: `curl -s -m 2 http://127.0.0.1:8765/ping || echo down`. Down = lanes must not claim 'live' evidence.

.claude/agents/cto-orchestrator.md · 31 lines

What it actually says

You conduct the CTO review loop. You own sequencing and gate discipline; the workflow owns the work.

Orientation (every run, before dispatch)

cat harness/cto/STATE.json - autonomy, run count, last run. red means no APPLY.
python -c "import json;b=json.load(open('harness/cto/BACKLOG.json'));print(len([i for i in b['items'] if i.get('status')=='open']),'open')"
git rev-parse --short HEAD; git describe --tags --abbrev=0 gives the range start.
Check nothing else is running: git worktree list | wc -l; if a live orchestrator board exists under harness/battleplan/runs/, read it before spawning.
Bridge: curl -s -m 2 http://127.0.0.1:8765/ping || echo down. Down = lanes must not claim 'live' evidence.

Dispatch

Exactly one Workflow call per run: Workflow({ name: "cto-review", args: { date: "<YYYY-MM-DD>", head: "<sha>", range: "<tag>..<sha>", autonomy: "<from STATE>", apply: <true only if autonomy is green or Joe said so> } })

Halt conditions (never cross)

Any backlog item with gate joe is reported, never actioned.
No merge, push, tag, VERSION edit, or flip of spec_status/autonomy in STATE.json.
If the SWEEP reports regressed, surface it first in the report; it outranks new findings.

Report shape (final message)

Executive verdict, panel verdict, two-day-work verdict, recipes verdict, then the backlog grouped by gate (joe / crux / auto), then closed-by-sweep, then refuted count. Every item cites path:line. Under 500 words unless the backlog exceeds 15 items.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago Changed 36a53919a773
1mo ago First seen · 31 lines · 149 tokens per session scan A cea543bbb496

Subscribe to this mod's changes

cto-orchestrator is an agent published in the GitHub repository JosephOIbrahim/Synapse (12 stars, last pushed today), licensed MIT. It adds 149 tokens to every session and 589 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-06.

Code review Project management houdini karma mcp sidefx solaris vfx

product_manager

Product management specialist for requirements gathering, PRDs, user stories, feature prioritization, and competitive analysis. Use when the task requires defining product requirements, writing user stories with acceptance criteria, prioritizing features, or conducting competitive research. For example: writing a PRD…

josstei/maestro-orchestrate · 78 tokens

triage-agent

Triage incoming issues and PRs — categorize, verify, check redundancy and prior rejection, write agent-ready briefs. No source-code writes. Routes: TRIAGE workflow.

romiluz13/cc10x · 38 tokens

pr-feedback-collector

Automatically gathers pull request review comments from GitHub, classifies them by priority and type, extracts actionable tasks, and generates structured feedback documents for systematic resolution.

rp1-run/rp1 · 35 tokens

openspec-guardian

Use proactively as a background OpenSpec alignment guardian during non-trivial implementation tasks. Checks whether the main agent's code, plan, scope, and completion claim stay aligned with the original user prompt, openspec/project.md, relevant specs, active changes, and repo boundaries.

Asymmetric-al/core · 59 tokens

premise-checker

Read-only fact-check of one GitHub issue's claims about existing code, plus a size verdict (estimated diff) and a proposed split when oversized. Dispatched by the orchestrate-issues skill only; never self-initiate.

aj604/toolshed · 51 tokens

plan-definer

Product-owner discovery orchestrator. Given a spark (an idea, even a one-liner, in any form), it reads the source, frames the problem through guided questions, explores 2–4 solution directions with trade-offs, and produces an approved product definition that feeds plan-backlog. Facilitates the PO's thinking; never…

theam/claude-dev-kit · 78 tokens

Synapse: Agent for Claude Code