Set up Private Access

Release status

Outcome

Pair two owned CLI devices, select an encrypted Private Endpoint, and mount it on loopback without Credit or paid fallback.

Prerequisites

1. Two devices on the same account
2. The released Private Access CLI
3. A compatible model runtime on the provider
4. An explicit pairing decision

Current path

1. Each CLI installation first becomes a distinct account device through one-time browser approval.
2. The released workflow will pair devices explicitly and exchange only an encrypted private catalog through the relay.
3. The consumer will select a Private Endpoint and mount it on loopback for local applications.
4. Public commands will be added after the CLI release channel and complete workflow are validated.

Authoritative success state

An authoritative pairing plus an active local mount whose native traffic remains end-to-end encrypted. This state is not yet exposed by the hosted account API.

Common failures and recovery

1. A failed private path must remain failed; it must not fall back to paid Network inference.
2. Revoke an account device if its credential may be compromised.

Security and privacy boundary

The relay sees routing metadata but not native private request or response content. The provider CLI alone owns its local model connection.

Next valid action