Machine identity
The phone verifies the enrolled machine instead of trusting a mutable address.
Security
Terminal access deserves a visible trust model.
See what is trusted, what is encrypted and which controls you can revoke today.
Pairing creates identity, not convenience debt.
QR enrollment is single-use and short-lived. The scan pins the machine before the phone receives a device-specific credential.
ScanShort-lived QR
PinMachine identity
ExchangeOne-time auth
EnrollRevocable device
Authority is layered and recoverable.
No network location becomes permission by itself. Device identity, live access and terminal control cross separate checks.
Short-lived access
WebSocket tickets expire after ten seconds and are single-use.
Bounded control
Observation, terminal input and administration remain distinct application capabilities.
Recovery
Revoke one device, sign out others or trigger panic recovery.
Know where plaintext exists.
Your code stays on the machine where it runs. Connections use HTTPS/WSS or private Tailscale.
Enrolled deviceDevice credential
HTTPS/WSS or private TailscaledenshindOn your machine
Local PTYTerminal plaintext
Security ledger
Claims need evidence.
- Pairing
- Single-use and time-bounded enrollment, with concurrent replay tests.
- Live channels
- Ten-second, single-use WebSocket tickets and explicit device credentials.
- Abuse resistance
- Payloads, sessions, retries and logs are bounded, and security events are auditable.
- Relay admission
- Signed Ed25519 machine bootstrap, exact Iroh EndpointId binding, one-use grants, post-auth lease promotion and distributed IP/installation quotas over transactional PostgreSQL.
- Adversarial testing
- Protocol confusion, replay, revocation, secret reflection, load and relay-outage campaigns run in CI-ready harnesses.