The Host binds to 127.0.0.1 by default. A non-loopback bind requires both REMOTE_MICRO_ENABLE_LAN=true and a non-empty development token shared with Mobile. The token is optional only on loopback and is never persisted in Mobile state, events, or logs. This is not production pairing or production transport security.

Codex authentication stays in the official CLI environment on Host. Mobile and Desktop never receive an OpenAI API key, Codex home path, Skill filesystem path, authorization header, environment dump, provider thread ID, or raw App Server payload. Skill and provider session IDs are mapped to opaque public IDs and resolved only inside the adapter. Provider stderr is bounded and centrally redacted.

Authenticated clients may select a Host-local workspace. Desktop obtains the path through the native operating-system folder picker; the shipped Mobile UI presents only paths already advertised by the configured workspace or the Codex session catalog. Host requires an absolute path, canonicalizes it with realpath, verifies it is an existing directory, and never creates a directory as part of session start. Canonical workspace paths are deliberately disclosed to authenticated clients for selection and resume, so production pairing and encrypted transport are required before use on an untrusted network.

Approvals default to explicit allow_once or deny; there is no automatic approval. A session-wide choice is exposed only when the exact provider request offers it. The adapter responds to the exact pending App Server request once, rejects stale/unsupported decisions, and cancels or expires pending requests on timeout, provider exit, or disposal. Host command IDs are persisted for at-most-once execution, so a reconnect or duplicate tap cannot run a command twice.

SQLite stores normalized domain metadata and RM Link events. It does not store provider credentials, API keys, complete environment variables, terminal stdin, command output, or complete original provider payloads. Commands, target paths, and diffs are deliberately visible to the authenticated reviewer because they are required for informed approval; they must still be treated as repository-sensitive data.

Production use requires short-lived pairing, per-device credentials in OS secure storage, WSS, revocation, biometric policy for high-risk approvals, and a reviewed LAN threat model. Those remain explicitly unimplemented, so NODE_ENV=production Host startup fails closed. Do not expose the development ws:// endpoint to an untrusted network.