Honesty
Human gates are the product.
When Orbit Yard stops and asks you to Open a vendor UI and Confirm, that is not an unfinished bug. That is the honesty layer — the part competitors skip with fake “all shipped” greens.
What you still do (on purpose)
- Put tokens and connection strings on the official host — Studio never writes deploy secrets
- Login CLI / Sign in (web) when the vendor requires your account
- Confirm after you finish irreversible work (listing, submit, live deploy)
How Verify stays honest
Disk
Project files and .ship metadata (scopes saved, TRUST.md present) — no secret values.
Local CLI
Signet, doctor, and deploy pulse on your machine — tools you already trust.
Official CLI probe
Your authenticated gh / wrangler whoami — Studio does not phone home with your keys.
Human attest
No automatic green for Polar paste, store listing, or store review — Open, finish there, Confirm.
What we refuse
- Pretending OAuth or store review finished because a spinner stopped
- Holding API tokens so Studio can “just deploy”
- Calling human gates “remaining work” in the marketing sense — they are the finishable cut
Operator catalog (commands · lanes): Human gates docs · product boundary: Intent · claims we ban: Scope of service.