docs(ecosystem): add OrcaReplay under Observability + cost

[xizhuomengcontin]

One line in ECOSYSTEM.md under Observability + cost, following the three requirements in "Submit an entry".

Disclosure: I work on OrcaReplay. Apache-2.0, free, no paid tier.

1. Real, public repo — https://github.com/Continuum-AI-Corp/OrcaReplay
2. One-line description — records a Hermes run with no instrumentation (TLS terminated for that run only) and replays it offline with the network off
3. Licence — Apache-2.0

Why it belongs in that section rather than beside Langfuse

Everything already listed there needs the run to be instrumented — Langfuse via the OpenTelemetry collector path Part 20 covers, Phoenix as OTel-native, Helicone by sitting in front as a gateway. That works, and it gives you a view of the run.

OrcaReplay is the other half of that trade. It keeps the verbatim request and response bytes rather than spans, which costs disk and buys something the OTel path cannot give you: the recording can be served back, so the same run executes again with the network off. Useful for exactly the thing this guide is about — reproducing a bad run cheaply instead of paying tokens to re-provoke it.

It is not a replacement for Langfuse. Langfuse is where a fleet's traces live; this is a debugger you point at one run.

Verified against Hermes, today

Hermes Agent v0.21.0, orcareplay 0.2.3 from npm, on Windows. No key needed — opencode-free is served anonymously.

npm i -g orcareplay
orca record hermes --tls-intercept --tls-hosts '+opencode.ai' -- \
  --provider opencode-free -m nemotron-3.5-lightning-free -z 'Reply with exactly the word: pong'

info recorded run=run_5283cb8b4c54 events=15 blobs=2 exit=0

$ orca show last
11   MODEL  nemotron-3.5-lightning-free   1 messages
12   MODEL  nemotron-3.5-lightning-free   stop: end_turn · 12,114 in · 40 out

$ orca replay last
info replaying exchanges=1 egress=blocked
info replay.done reused=1/1 exit=0

The CA is generated per run, trusted only by the process orca launches, and deleted when the run ends — it is not installed into the system store.

Two limits, since this guide is the kind that would rather know

• Hermes fires a one-message background call and abandons it. It shows up as status 0 · client left. orca keeps it as network traffic rather than a replayable exchange, so a strict replay reports unmatched=1 for it, and on a multi-turn recording its position can stop a strict replay early. --loose carries it through.
• Forking a Hermes run onto a different model does not work. It does for harnesses orca redirects by base URL; Hermes is captured by terminating TLS instead, and on test the --model override was accepted and had no effect. So the entry claims record and replay only.

Happy to shorten the line, move it, or drop the licence tag if that is only wanted for MCP servers — I included it since it is free either way.