Orrery is the platform. Ceres is the first planet on it.

Direction cascades down. Truth cascades up.

Orrery models a company as a chain: what the company decided to accomplish, the plan that serves it, the milestones that plan breaks into, and the day-to-day work that produces them. Cost matures the same way — budget becomes an estimate becomes an actual — and the gap between levels is itself a signal, not something to hide.

Status is never a field someone edits. It's computed from the work underneath it, the same way a thermometer reads temperature instead of being told what to say.

Planets, not one monolith

A planet is a named bundle of capability built on the same foundation — its own identity, sold on its own or together. Ceres is planet one, starting with the sales pipeline: every deal, its next recommended action, and when the cash is expected to land.

Isolation is the foundation, not a feature

Every tenant's data lives behind row-level security enforced by the database itself, checked on every table, in both directions, on every change to the platform — not just trusted to application code to get right. Nothing a tenant does ever trains, informs, or is visible to another tenant's account.

Full public security summary — the "one-pager" a buyer's security team can read in five minutes — is planned but not yet published here.