Tasks signed, gated, and receipted end to end.

When a task reaches a final state, the router makes a best-effort deletion of an input object that is provably owned only by that task and no replica still needs. A 15-minute sweep catches eligible terminal inputs after a one-hour safety grace; shared uploads, external URLs, or an object still referenced by live work are not guessed at or deleted. A separate 30-day outer sweep covers stored customer artifacts, including results, and can take additional runs if its bounded deletion limit meets a backlog. You can also request deletion of a finished job's payloads with DELETE /v1/jobs/{id}/data. Everything customer-scoped is queried by account: your jobs, devices, and receipts are filtered by your user id on every read, and API keys are stored only as a per-key-salted HMAC, so a database copy on its own doesn't yield a usable key. Large payloads move over a bridge that redeems a short-lived, server-signed token pinned to one exact object — a provider Mac computer cannot enumerate the bucket or reach another customer's file. Billing and audit metadata (amounts, timestamps, job ids — not payload bodies) is retained longer.

Job inputs reach the runner only through a single chokepoint that refuses anything except HTTPS to public hosts. Loopback, RFC1918 home networks, AWS metadata addresses, and link-local IPs are rejected — even via redirect, with the destination IP re-validated after each hop. Downloads are magic-byte checked: a runner asking for an image cannot be handed a script. Per-task inputs and outputs are scoped to that task; note that runner processes and loaded model weights are deliberately reused across jobs on a given Mac computer, which is what keeps warm-start latency low.

The macOS app runs under Apple's hardened runtime and ships signed with our Developer ID, notarized by Apple, with the notarization ticket stapled to the disk image — so it installs without a Gatekeeper warning. Every Sparkle update is additionally EdDSA-signed with a private key we hold; your Mac computer refuses any update that doesn't verify against the public key baked into the shipped binary.

The App-Sandboxed provider app declares `com.apple.security.network.client` for outbound calls — there is no `network.server` entitlement and no listener anywhere in its source, and no camera, microphone, or contacts entitlements exist at all. The isolated XPC compute service is separately App-Sandboxed and has no network entitlement. (One host entitlement, `disable-library-validation`, exists solely so Sparkle's separately-signed updater helpers can load under hardened runtime; it is compensated by EdDSA verification on every update.) All outbound traffic is TLS 1.2+. The blanket ATS exemption present in pre-1.5 builds is gone.

The router signs each task assignment with Ed25519. Your Mac computer refuses anything that doesn't verify against the pinned public key, with a 5-minute clock-skew window and replay protection. On completion we settle billing against the recorded result, and every completed job gets a receipt — input/output hashes, price, the pseudonymous completing device, immutable provider trust evidence, and the concrete process boundary that handled task plaintext — which you can fetch from `GET /v1/jobs/:id/receipt`. That boundary is either the sandboxed provider app or, for a workload that has shipped it, a fresh no-network XPC worker; neither label makes the assigned provider unable to read work it brokers. Sharded jobs carry a bounded count of completed executions by captured trust state. To be precise about what that receipt is: it carries a platform signature (HMAC-SHA256 with a key we hold), so it proves the record came from us and has not been altered, but it is not a third-party-verifiable proof and it is not signed by the provider's Mac computer. Per-device provider signatures are built but not yet shipped.

Your session token lives in the macOS Keychain under kSecAttrAccessibleWhenUnlockedThisDeviceOnly — physically inaccessible to anything running while the screen is locked, and never synced via iCloud Keychain. Existing entries from older builds were upgraded automatically on first launch of 1.5.0.

The currently offered Qwen snapshots are identified by an immutable repository revision and an exact file inventory with SHA-256 digests. The provider verifies the Common Compute-signed manifest, downloads only that inventory, hashes the staged tree, and obtains a fresh signed authorization for the same snapshot before the no-network worker starts. Missing, changed, unsigned, or extra files fail closed. This is software supply-chain evidence, not hardware attestation or proof that a provider-owned host could not observe public model weights or assigned plaintext. Dormant runner code and registry rows outside the offered catalog are not covered by an availability claim.