Approve the owner
GitHub's official Device Flow is used for enrollment. A new Device identity must have its own valid authority; an old lease never grants authority to a new Device.
Trust / Permission model
Access should be
explicit and reversible.
Your machine remains the execution environment. Local Computer connects approved local resources to an authenticated client without turning the website into a remote desktop or data store.
Authorize the client
ChatGPT's OAuth client grant belongs to the selected Device. The protected MCP endpoint requires authentication; a public URL alone cannot authorize tool use.
Scope the work
Folder access, OS permissions and dynamically discovered capabilities are separate decisions. A workspace folder ID is not a shell sandbox.
What runs where?
The device runs the Runtime, commands and local file operations. The Staging Cloud provides account and Device registration, a managed network endpoint and limited connection metadata. A tunnel is not an authorization token.
Device credentials, local workspace files and command outputs are not intended to be published in static website content or the machine-readable distribution catalog. A client receives task results through the authenticated runtime channel.
Clear permission boundaries
- File grants: explicitly approved folder paths, with a separate revoke path.
- Commands: inherit the underlying user's OS capabilities; evaluate proposed commands before allowing them.
- OS privileges: macOS TCC permissions and Linux privileged installation are platform-specific; Local Computer cannot silently grant them.
- External sources: capability catalog discovery does not itself authorize an external service.
Exit paths aren't interchangeable
Disconnect halts a connection; OAuth revoke invalidates a particular client's access; Device Revoke is a remote authority change; Cloud Remove is remote record management; Reset local clears local identity; Uninstall removes product-owned software. One must not be presented as proof of another.
A previously unknown Cloud provisioning effect stays fail-closed until it can be safely reconciled. Historical failed records can remain isolated without preventing a genuinely new Device identity from proceeding.
What is not ready for public release?
Linux Build487 and macOS Intel Build490 both have real Runtime/ChatGPT MCP acceptance; their current Staging archives are checksum-verified. Linux remains unsigned, and macOS Build490 has only Apple Development signing rather than Developer ID notarization. Independent fresh-device consumer installation and Production Website Release Gate are still open. Windows is deferred. We do not claim zero risk or a complete security audit.
Inspect release status and setup & recovery before testing.