orch

This is a readable local command-line fixture that executes commands configured in ROOT/host.json through the dispatch and verify actions, then records results in ROOT/actions.jsonl. If an untrusted party can control host.json or invoke these actions with attacker-modified state, the command execution can cause arbitrary effects with the program's privileges. No network exfiltration, credential targeting, or obfuscation is evident in this fragment; severity is conditional on control of the state file.