False-ready
A green local step is not a delivery decision.
The failure mode is familiar: the agent says done, a local check passes, and the human reviewer still finds a blocker. Orcho makes that blocker a state transition, not an after-the-fact comment.
- validate_plan can reject unclear or unsafe plans before code starts.
- review_changes can block the run with named findings.
- repair_changes resumes from the same record, preserving the rejection and the fix.