Tasks signed, gated, and receipted end to end.

A prompt that ran in four seconds used to sit in storage for a month. Now the input is deleted as soon as the job reaches a terminal state — the router purges it on completion, and a sweep every 15 minutes catches anything that path missed, so nothing depends on the fast path having worked. Results are kept longer for the obvious reason that you still have to fetch them, and are removed by the 30-day sweep; that window is enforced in code, not by policy, and has a floor so a misconfiguration can't collapse it to zero or extend it silently. You can also delete a finished job's payloads yourself at any time with DELETE /v1/jobs/{id}/data. Everything customer-scoped is queried by account: your jobs, devices, and receipts are filtered by your user id on every read, and API keys are stored only as a per-key-salted HMAC, so a database copy on its own doesn't yield a usable key. Large payloads move over a bridge that redeems a short-lived, server-signed token pinned to one exact object — a provider Mac cannot enumerate the bucket or reach another customer's file. One limit worth stating plainly: billing records (amounts, timestamps, job ids — not payloads) are retained beyond all of this because we have to.

Job inputs reach the runner only through a single chokepoint that refuses anything except HTTPS to public hosts. Loopback, RFC1918 home networks, AWS metadata addresses, and link-local IPs are rejected — even via redirect, with the destination IP re-validated after each hop. Downloads are magic-byte checked: a runner asking for an image cannot be handed a script. Per-task inputs and outputs are scoped to that task; note that runner processes and loaded model weights are deliberately reused across jobs on a given Mac, which is what keeps warm-start latency low.

The macOS app runs under Apple's hardened runtime and ships signed with our Developer ID, notarized by Apple, with the notarization ticket stapled to the disk image — so it installs without a Gatekeeper warning. Every Sparkle update is additionally EdDSA-signed with a private key we hold; your Mac refuses any update that doesn't verify against the public key baked into the shipped binary.

The provider app declares `com.apple.security.network.client` for outbound calls — there is no `network.server` entitlement and no listener anywhere in its source, and no camera, microphone, or contacts entitlements exist at all. Being precise about what that buys: the app is not App-Sandboxed, so those absences are choices we made and can be audited on, not boundaries the OS enforces. (One further entitlement, `disable-library-validation`, exists solely so Sparkle's separately-signed updater helpers can load under hardened runtime; it is compensated by EdDSA verification on every update.) All outbound traffic is TLS 1.2+. The blanket ATS exemption present in pre-1.5 builds is gone.

The router signs each task assignment with Ed25519. Your Mac refuses anything that doesn't verify against the pinned public key, with a 5-minute clock-skew window and replay protection. On completion we settle billing against the recorded result, and every completed job gets a receipt — input and output hashes plus the price — which you can fetch from `GET /v1/jobs/:id/receipt`. To be precise about what that receipt is: it carries a platform signature (HMAC-SHA256 with a key we hold), so it proves the record came from us and has not been altered, but it is not a third-party-verifiable proof and it is not signed by the provider's Mac. Per-device provider signatures are built but not yet shipped.

Your session token lives in the macOS Keychain under kSecAttrAccessibleWhenUnlockedThisDeviceOnly — physically inaccessible to anything running while the screen is locked, and never synced via iCloud Keychain. Existing entries from older builds were upgraded automatically on first launch of 1.5.0.

Model bundles fetched through ModelManager carry an expected SHA-256 in our manifest. The Mac hashes every byte after download and refuses to load anything that doesn't match — and refuses to load at all if the manifest has no hash for that model, rather than falling back to unverified bytes. Two honest limits: the manifest itself is not yet signature-verified on-device (a signing key is provisioned but the unsigned path is still accepted during alpha), and several runners load weights through their own framework's downloader rather than ModelManager, so those bytes are not hash-pinned. Closing both is tracked work, not a shipped guarantee.