Isolation model

Tasks execute in native runners on provider Macs, dispatched only via an Ed25519-signed task assignment the Mac verifies against a pinned key. Job inputs must pass a single trusted-download gate that allows only HTTPS to public hosts. There is no OS-level container: the provider app is not App-Sandboxed today, and runners are reused across jobs rather than spawned per task.

• Per-task input gating — HTTPS-only, private ranges refused, magic-byte checked
• Per-task scratch dir under ~/Library/Caches, swept on lease cleanup (not a kernel-enforced boundary — no App Sandbox yet)
• The app declares only an outbound-network entitlement and opens no listeners anywhere in its source — with no App Sandbox, that is a property of how it is written, not an OS-enforced boundary
• API request logs keep route, status, latency, client IP and user agent for 30 days — never request or response bodies