Local credentials
Relay Console stores credentials in macOS Keychain. Exports, logs, and support bundles must not contain raw secrets.
Runtime boundary
Hermes Agent or OpenClaw runs on the same Mac under your control. Relay Console uses a local runtime connection and does not open a remote runtime bridge.
Marketplace authority
Only certified Available Now providers can connect. Capability selection, approvals, input and output limits, audit records, revocation, and post-disconnect denial remain enforced.
Software updates
Public releases use Developer ID signing, Apple notarization, and a signed Sparkle appcast. Relay Console rejects unsigned update metadata.