Trust model

The Orbe works before the cloud appears.

V0.1 is intentionally boring where it matters: static files, explicit prompts, local returns, and no invisible side effects.

Hard rules

  • Local-first core.
  • No automatic upload.
  • No automatic sending.
  • No terminal execution from received Orbes.
  • No real API keys in the repo.

Cloud role later

Cloudflare and GCP help distribution, metadata, and assets after explicit user action. They do not replace the autonomous Orbe.