A Chat PIN Must Never Type
If a credential that opens Pippa chat can also open a terminal keyboard, you have built the model-callable write this quest keeps refusing, only now it fits in a pocket. The gateway checks the connecting device's tailnet identity and an operator-owned read/control permission. No model credential. No sibling HTTP credential. No long-lived password stored in the app as a substitute for the device. Editing a Mac's row cannot redirect an existing connection or its automatic reconnect into a different host, and an invalid address is refused without touching the old one.
Read permission is observation. Control permission is the right to type into that Mac's sessions beside whoever else is there, and to hold one briefly. A device approved only to look cannot type, resize or hold, no matter how many times the thumb taps. That split is how you lend a glass to someone who should see a job and never type in it.
Office Is a Default, Not a Prison
Known fleet Macs are one tap away. A fresh install starts out knowing the family's office Mac. A custom address stays available for the day one changes. None of that is a license to print tailnet addresses in a quest, or to bake a single host into the binary as destiny. The working contract uses one gateway per Mac, each approving devices for itself. The authorized destination, the next track, is a phone that can also go direct. Today's credential is still the device, not a password you could paste into a model.