The boundaries that hold when session work runs on a throwaway machine: what the worker may call, which credentials it receives, and which never leave the Gateway.

Security model

• Closed worker ingress. In worker-turn mode, the enrolled node launches the worker child, which dials the Gateway's authenticated public worker route and speaks a dedicated protocol with a closed method allowlist — a worker cannot call operator RPCs.
• Gateway-owned tool authority. In worker-turn mode, the Gateway applies the shared local tool assembly policy and sends exact tool definitions and resolved filesystem policy in the worker admission response. The installed node's launch envelope caps placement-local implementations; Gateway-owned tools use the issued surface independently of the supervisor's tool vocabulary. Explicitly capped scheduled turns reuse their trusted owner-group context without sending that identity to the box. Tools outside the issued surface remain unavailable; an empty result runs with no tools.
• Turn-bound Gateway tools. Every Gateway-owned tool in the prepared surface uses one closed invocation transport, gated by the same-build worker-gateway-tools-v1 feature. The Gateway installs the matching worker artifact through the existing node-supervisor contract. Handles belong to the exact admitted run, claim, environment epoch, and placement generation. Every invocation revalidates current authority; the worker cannot choose another source session or an operator RPC. Tool effects and before/after hooks stay with their Gateway owners and the retained plugin generation. Cancellation and updates use the same worker connection without blocking heartbeats or transcript acknowledgments. Canceling a queued Gateway tool call prevents it from starting; tools already running retain cooperative cancellation and settlement. Presence queries retain their timeout and end when the worker connection closes. Spawn/send retain their durable replay election, topology restrictions, and uncertain-outcome handling; reconnect never creates a fresh operation identity.
• Minted credentials, hashed at rest. Each dispatch mints a worker credential; the Gateway stores only its hash. Credential rotation and owner-epoch fencing guarantee at most one live owner per session — a stale worker that reconnects is fenced, never merged.
• Environment-bound enrollment. A node-only setup credential is bound to the durable environment and can enroll its first device only while its enrollment is live. Closing or timing out an uncompleted enrollment revokes the credential; replay issues a fresh credential for the same setup identity. After a Gateway restart, only a live replacement enrollment may adopt a surviving pending credential. The first authenticated Ed25519 device identity is recorded atomically with setup completion; same-device delivery retries remain valid, and replay cannot substitute an unrelated node.
• Explicit Codex node authorization. Cloud-node and paired-device remote execution require an explicitly allowed codex.exec-server.stdio.v1 command, an approved pairing surface, and critical node invocation approval. Allow once never grants a later launch. Allow always creates an in-memory standing grant owned by the current Gateway process, with a 30-day maximum lifetime. Gateway restart clears it, and every launch revalidates the exact active placement, node pairing, environment owner, command approval scope, and workspace immediately before dispatch. The managed exec-server starts with a fresh private home and sanitized environment. Its managed workspace is not an OS sandbox: approved execution can access processes and files allowed to the node account, so use a separate least-privilege account when isolation is required.
• Model placement is explicit. Apus worker turns proxy inference by {provider, model} reference by default, keeping Gateway model credentials off the worker. Worker-local inference on an explicitly configured paired-device profile instead uses node-provisioned model configuration and opaque external-proxy auth; the Gateway still sends only the model reference and authorized placement choice. Keep the trusted Gateway and credential custodian outside an untrusted workload, and never provision actual provider keys there. Startup transport and redaction are not same-user isolation. Codex remote-exec keeps the app-server plus ChatGPT subscription or API-key auth on the Gateway and sends only sandbox operations to the box. Remote-exec requires prepared auth and rejects ambient auth fallback. Crabbox AWS lease metadata is checked authoritatively for an instance role before setup. Keep setup commands credential-free too.
• Turn-bound GitHub identity. Apus worker turns receive the Gateway's effective shared GitHub access token through the private launch envelope, refreshed for each turn. The worker materializes it in a private profile inside its throwaway state directory. Each turn gets its own profile directory, and earlier turns' profiles are removed before the next binding, so a process retained from an earlier turn keeps only the token it was launched with. That rotation limits inherited paths, not same-user access: processes running as the worker's operating-system user, including the agent's own background commands from earlier turns, can read worker state, exactly as on the Gateway host. Cloud workers are single-session throwaway machines; run a paired session host under a dedicated least-privilege account when isolation from the agent's earlier commands is required. The sealed worker launcher reads that profile for each exec launch and exposes the token only to the child process; it is never logged or journaled. Paired devices' own gh logins are not used.
• Gateway-owned GitHub publication. Control UI and Codex remote-exec publication use the Gateway broker, with credentials from the selected GitHub profile on the Gateway. Repository sessions publish an accepted Git-normalized checkpoint through GitHub's tree, commit, and compare-and-swap ref APIs. Gateway-worktree sessions use a temporary index, git commit-tree, and a command-local credential helper. Both paths disable repository hooks and reject unsafe Git configuration. Neither writes a bearer token to argv, a remote URL, .git/config, a publication request, or a transcript.
• Provider-owned egress. Gateway-proxied inference removes any Apus need for direct model access, but Apus does not rewrite provider firewalls. Restrict outbound traffic in the worker provider when the task requires it.
• Durable, exactly-once worker transcripts. In worker-turn mode, the worker commits transcript batches through a compare-and-swap protocol against the session's leaf; a stale base fail-stops the run instead of duplicating or rebasing paid output. Remote-exec writes through the Gateway's normal local harness path.