• Chad's human Buzz/Nostr private key remains on a human-controlled device.
• The relay has its own server key and closed membership list.
• Every agent has a unique Nostr key and Unix/service boundary.
• The first coordinator receives only PfTerminal's ChatGPT auth file through a systemd credential and an ephemeral CODEX_HOME; it cannot read the vault.
• Any future provider API key must originate in PfTerminal's encrypted vault and reach a service only through a reviewed RAM-backed credential path.
• Git, SQLite and existing production services remain independent authorities.

Never commit, post to Buzz, print to logs or send through chat:

• private Nostr keys or recovery material;
• provider, GitHub, Telegram or service tokens;
• wallet/seed material;
• .env contents or database passwords;
• internal credential-routing labels that are not already public contracts.

Public identities should be shown as short fingerprints except where an exact value is required through a local file or command substitution.

• Bind the relay to exactly one loopback/Tailscale address.
• Require authentication token support and relay membership.
• Do not add Caddy, a public hostname or public TLS ingress in Phase 1.
• Treat relay administrators and host root as able to access stored content; do not put secrets in messages even on a private relay.

The first coordinator is:

• owner-only;
• mention-driven;
• one process;
• heartbeat disabled;
• no autonomous publishing or external action;
• scoped to /srv/city2, a read-only bind of the reviewed repository, while the rest of the user's home is inaccessible;
• unable to access the PfTerminal vault after startup.

The relay signer retains the agent's Nostr key, but the Codex ACP launcher removes it from the model-runtime environment before any model or tool process starts. The ChatGPT runtime credential remains available only through the service-private ephemeral CODEX_HOME required by Codex itself.

Channel membership is not a filesystem sandbox. Systemd hardening and Unix identity boundaries remain required.

• Relay image is pinned by immutable digest.
• Compose is copied from a reviewed upstream commit.
• Agent tools are built with cargo --locked from that commit.
• The Codex ACP adapter and bundled Codex runtime are pinned by npm lockfile.
• Generated binaries and checksums are local build output and are not committed.
• Version bumps require source review, rebuilt tools and the disposable E2E.

Buzz workflow approval suspension is not treated as a complete security gate. Deployment, publication, financial actions, third-party messages and production schedule changes require explicit owner approval plus a separately enabled operator path.