The promises that don't bend, enforced in code — not vibes.
Secrets redacted on intakeRaw API keys never reach a database or a page — imports, pastes, Bug Bench, plans.
Display-only codeCommunity code streams as text and is never executed.
Per-user isolationYour projects, chats & files are yours alone — enforced and scanned.
Honest status, never faked greenUnknown stays grey. "Done" only means real code ran and a human saw it pass.
Money reconciles to the centHeld payments (in Program Podz's own Stripe account until the buyer accepts) & payouts on tested rails; live money gated behind sign-off.
Tamper-evident audit chainsPricing edits, daily content & board posts each hash the previous entry.
Rate-limited & scam-scannedPosts are throttled; board & teach links scanned before they go public.
Answers never leakDaily games send answer-stripped payloads; the answer shows only after you lock.
Your computer stays yoursThe Bridge never touches your disk from the cloud — a local companion acts only inside one folder you grant, only after you approve each step, with a one-click kill switch and full audit.
Full-Parity is opt-in & supervisedMaestro's "do everything" mode is off by default; it needs a premium entitlement AND your explicit consent, runs one approved action at a time (or a whole sprint via Run Mode), blocks catastrophic commands, and never runs unattended.
Never-blank guaranteesThe daily game & The Build always have content via an evergreen vault.
Compliance never guaranteedAccessibility & privacy are planned in, but stay grey until a human confirms — we always point you to qualified counsel.
View ≠ interactProfiles are private by default with an opt-in public tier — anyone may view a public profile, but only friends & crew may comment, like or DM; DMs are friends-only; a blocked user can never see or message you.
Real data rightsExport or delete everything tied to your account — including friends & direct messages — honored in code.
No fabricated feedsThe Daily Top 5 ranks only approved sources with honest excerpts; discussion is escaped, moderated & never indexed.
Secure per-Pod uploadsUploads are size-capped, executable file types are blocked, and files land outside the web root under random names — only a signed-in Pod member can upload.
Real money stays off until sign-offPayments are proven in Stripe's Sandbox first; live money, agent compute and publishing each need their own formal release, and any of them can be stopped instantly.
Agents on a short leashEvery agent has hard spending caps, metered internet and a sealed room; more room is earned through trust or approved by an admin — never assumed.
Admin powers are fencedAn admin PIN guards the controls, View-As is read-only and watermarked, and every attempted write is refused and logged.
Every long build has a ceilingA cost and time estimate before Run, a hard ceiling during, a visible meter, save points to roll back to — and Maestro asks before it spends more.
Own it before you mod itModding or decompiling a game needs your ownership attestation at every step; anything fetched from the internet carries a licence record; a publish rule refuses to ship assets you don't own.
Fair-use tiers for everyoneVisitors read, verified accounts post within fair allowances, and limits tighten automatically when the city is very busy — with an honest "try again in a moment".
Held for review, not shownSpam, scams and prompt-injection tricks are held for a person to review; three independent reports hide anything; new accounts can't gang up.
Storm mode never lifts itselfWhen the city or the money runs hot, Storm mode steps in by itself — but only the owner, with the admin PIN, can lift it.
Status without secretsThe public status page explains problems in plain words and never shows names, addresses or what the incident was about.
No accidental database moveThe move to Postgres is rehearsed with a half-second rollback and refuses to run live without its own separate go.
Read-only doors for AI agentsThe agent card, text doors and MCP server let agents read everything they need and change nothing; the card is signed so anyone can verify it.
Scanned before it's publicUploads and agent facades go through a real virus scanner; the publication switch will not open until a scanner actually answers.
A closed money switch never drops to SandboxNew live charges are refused as "paused"; existing live payments keep their own mode; nothing silently reroutes.
Peer-to-peer video, gatedCamera & mic never auto-start; the Knerds video table connects browser-to-browser — the server only carries the handshake, never your video — and only signed-in seat-holders can join.