The Host binds to 127.0.0.1 by default. A non-loopback bind requires both REMOTE_MICRO_ENABLE_LAN=true and a non-empty development token shared with Mobile. The token is optional only on loopback and is never persisted in Mobile state, events, or logs. This is not production pairing or production transport security.

Codex authentication stays in the official CLI environment on Host. Mobile and Desktop never receive an OpenAI API key, Codex home path, Skill filesystem path, authorization header, environment dump, or raw App Server payload. Skill paths are mapped to opaque public IDs and resolved only inside the adapter. Provider stderr is bounded and centrally redacted. Handshake diagnostics replace the absolute workspace path with <workspace>; the configured path is canonicalized with realpath, must be a directory, and cannot be selected by a client command.

Approvals default to explicit allow_once or deny; there is no automatic approval. A session-wide choice is exposed only when the exact provider request offers it. The adapter responds to the exact pending App Server request once, rejects stale/unsupported decisions, and cancels or expires pending requests on timeout, provider exit, or disposal. Host command IDs are persisted for at-most-once execution, so a reconnect or duplicate tap cannot run a command twice.

SQLite stores normalized domain metadata and RM Link events. It does not store provider credentials, API keys, complete environment variables, terminal stdin, command output, or complete original provider payloads. Commands, target paths, and diffs are deliberately visible to the authenticated reviewer because they are required for informed approval; they must still be treated as repository-sensitive data.

Production use requires short-lived pairing, per-device credentials in OS secure storage, WSS, revocation, biometric policy for high-risk approvals, and a reviewed LAN threat model. Those remain explicitly unimplemented, so NODE_ENV=production Host startup fails closed. Do not expose the development ws:// endpoint to an untrusted network.