OAuth with proof of possession
Authorization Code with PKCE, one-time codes, hashed tokens, revocation, and per-tool scopes.
Security model
Small surface.
Strong boundary.
The gateway, workspace runner, and TLS edge are separate services with narrowly defined responsibilities.
One controlled mount
Only the runner sees the workspace. The gateway has no workspace, Docker socket, host home, SSH keys, or Codex state.
Restricted containers
Read-only root filesystems, dropped capabilities, non-root users, and no-new-privileges reduce the impact of a compromised process.
Separated paths
The gateway and runner do not share a Docker network. Tool traffic crosses a dedicated Unix socket with audited requests.