The feedback loop: send Orbit's developer an idea from inside Claude, and let friction report itself
Orbit could fail you and you had no way to say so beyond closing the tab. Two new tools and one new telemetry signal fix that. Ask for a capability Orbit doesn't have and Claude can now offer to file it: orbit_submit_product_idea sends a feature request to Orbit's developer — composed with you, shown to you verbatim before it goes, redacted on your machine (emails, URLs, file paths, keys and number sequences are stripped before sending), never published anywhere, and retractable any time with the ref it hands back. Passively, Orbit now notices when things go wrong on their own: a tool that fails three times in a row, or a request that matched no skill at all, sends a friction signal — the only telemetry that carries any text, always redacted on-device first, and covered by the same one-variable opt-out as everything else.
What shipped
•New tool — orbit_submit_product_idea. When Orbit can't do what you asked, Claude offers to file the idea with Orbit's developer. The consent contract is in the tool itself: the text is composed with you and shown verbatim for your approval before anything is sent, on-device redaction strips emails, URLs, file paths, key-shaped tokens and number sequences, and the response echoes back exactly what left your machine — plus a ref. Ideas land in a private inbox, never on a public page. Capped at five per install per day.
•New tool — orbit_retract_product_idea. Hard-deletes a submitted idea by its ref, from the same install that sent it. Deleted means gone from the inbox, not hidden.
•Friction telemetry. A tool that fails three times consecutively in one session emits one signal per streak (a success resets it); a request orbit_route_task can't match to any skill sends the request text after the same on-device redaction. This is the only telemetry event that carries free text, it is never verbatim, and ORBIT_TELEMETRY=0 silences it along with everything else. The idea tools are deliberately separate: an explicit submission works whether telemetry is on or off, and never touches the telemetry endpoint.
•Every published privacy promise updated to match — the telemetry module's own contract, the one-time stderr disclosure, and the website privacy policy now say exactly what a friction signal can carry and what can never leave your machine.
•New skill — braze-canvas-conformance, with a runnable checker: lints live Braze canvases against a naming and tagging convention over the REST API (canvas name shape, tag cardinality, retired tags, default step names), read-only, and exits non-zero so it can gate a pre-send check.
•Slop detector learns the staged-reveal opener — 'the number I keep coming back to is…' now scores as the manufactured-revelation move it is, same family as 'what surprised me most'.