Nine controls, each of them a switch you can see, not a promise
you have to believe.
Pairing
A device gets in once, by your hand
The agent shows a QR code and a typed code carrying a
one-time secret. It expires on a clock, and it dies at first use.
- Both sides compute the channel fingerprint and show it. Pairing
completes only when you confirm it on both; a mismatch aborts and
lands in the agent's security log.
- The agent keeps the list: name, kind of device, when it was paired,
when it last connected, its fingerprint.
- Revoke a device and its live connections drop immediately; the
credentials it was issued stop working, and the app wipes its cached copy
of that Mac.
- All of this works on the local network with no outside
infrastructure involved at all.
Visibility scope
The Mac hands over folders, not a file system
You register a directory under a human name. Anything
outside it does not exist as far as the phone is concerned.
- Every file, search and git operation is checked against that boundary
after symbolic links are resolved — a link pointing out of the
workspace does not become a door.
- A workspace can be read-only. So can one folder or one file inside a
writable one; where the two disagree, the stricter mode wins.
- The rules are set on the Mac and nowhere else. The phone is told the
effective mode of every item and shows it before you try to
write.
- One switch decides whether a workspace's files may leave the Mac at
all. Forbidden means: not saved on the device, not even offered for
saving, not handed to other apps — and whatever was saved earlier is
deleted.
- Delete a workspace and every session and subscription tied to it closes
with it.
Permissions
Nothing dangerous is on when you unpack it
Ending processes, managing long-running ones, typing a secret
into a sudo prompt, continuing a Mac terminal session, previewing
local servers, changing databases and reading the databases of apps in the
iOS simulators from the phone are seven separate switches, and all seven start
off.
- Turning one off takes effect at once: an operation in flight is
refused, while managed processes keep running and stay visible on the
Mac.
- A refusal names its cause. «Switched off on the Mac» is distinguishable
from «not permitted» and from «not your process» — and the app says where
the switch lives.
- The secret for
sudo is released by Face ID on the device
and travels as its own operation, not as keystrokes in the stream. The
Mac's owner allows that separately; by default it is off.
- A read-only workspace is enforced for the terminal too — including the
processes it spawns — and if that enforcement cannot be applied, you are
told instead of being left to assume it.
Reach
One device at a time, unless you say otherwise
By default exactly one device works with the agent at a
time. The setting runs from one to five, or off entirely. The seat belongs
to the device, not to the connection.
- A device over the limit is refused with the reason named — not dropped
quietly.
- The relay can be forbidden per agent: direct and local only, or
nothing at all.
- The list of rendezvous nodes is an agent setting, not something baked
into the app. An empty list means local network only — and that is
a supported way to run, not a broken one.
- A node from the published catalogue joins the working list only by your
action. The catalogue lookup itself switches off, and the product stays
fully usable without it.
Location gate
Only a device that says where it is
Switch it on and a connection is established only by a
device that names its location. A device with location turned off or denied
is refused — with the reason, and with where to enable it.
- The place is written into the access log with its precision and the
mark «as stated by the device» — because that is precisely what it
is: stated, not verified. The agent does not pretend otherwise.
- A refusal for a missing location is recorded exactly the way an
admission is. The gate leaves a record either way.
- It is a gate, not a tracker: what the device said at the moment of
connection is kept, and nothing between connections.
Access log
Every operation, and never its content
The agent records what a connected device asked for: the
moment, the device, the kind of operation, how it ended, and the subject
named by the request itself.
- The subject is the path, the branch, the process, the search string,
the bytes transferred — whatever the request named.
- Connecting and disconnecting are recorded alongside operations.
- Never: file contents, command output, terminal input, or a word
of an AI conversation. Not at any level of detail.
- The same operation on the same subject from the same device inside a
window increments a counter instead of adding a line.
- Bounded by age and by size; the oldest records go first.
- Filter it by device, by kind, by a fragment of the subject. Export it
as a file to read elsewhere. Switch it off — and the switching is itself
written into the log.
- A failure to write never cancels or delays the operation it was about
to record.
- The protocol has no operation for reading it. It cannot be
fetched by the phone, by us, or by anyone: it is read on the Mac, by the
person sitting at it.
Copies
The Mac hears what became of the file it handed over
The device reports the fate of what it received: kept on the
device, sent to another app, deleted.
- When the system names the receiving app, the report names it too.
- A claimed record is marked as claimed and stays distinguishable from
what the agent observed itself — both in the log and in the
interface.
- The report survives a lost connection and arrives with the next
one.
- And the interface says the uncomfortable part out loud: no report
does not mean no copy. A guarantee that cannot be enforced is not
offered as one.
Apple Watch
A watch gets its own key, and you sign for it
The watch has its own key pair. Its authority is delegated
by the iPhone, and the agent accepts that delegation only after you confirm
it on the Mac.
- The delegation has a lifetime and renews on contact with the
iPhone.
- Revoking the iPhone invalidates everything the iPhone delegated.
- Risk decides what the wrist may do: refusing is always allowed;
approving is available at low risk, takes a crown turn at medium, and at
high risk goes to the phone. A request recognised only heuristically is
approvable from the watch at low risk alone.
- File operations and git are not available from the watch at all.
Power
The Mac stays awake, because a locked Mac cannot help you
While the agent runs it holds the Mac back from locking the
screen. A locked Mac cannot assemble its keys, and the connection fails —
so this is a default, not a hard rule.
- The holding switches off, and then a locked Mac refuses connections
naming that reason rather than timing out into a generic
error.
- The agent keeps its own log of privileged operations on the Mac,
separate from the access log.
ShiftStage