OXYGENHUB

Runners staff can turn on safely: encrypted work, nothing at risk if a phone is lost issue #11 open andymccall opened this · 1 comment

andymccall

Enterprise ask (Andy, 2026-10-24): staff turn the runner on with their phones, and a lost phone puts nothing at risk.

  • At rest: Android's file-based encryption, plus the runner's caches and workspaces in a store encrypted with a key in the Android Keystore (StrongBox where present), never exportable; or 'ephemeral mode': nothing kept between jobs.
  • Keys: no long-lived signing key on the phone; receipts signed with ten-minute keyless certificates (as runners can already, oxygenhub#241); the runner credential bound to the device key.
  • Secrets and job data: given to the job in memory for its life only, job tokens expiring with the job.
  • Lost phone: the organisation (or the owner) revokes the runner on the hub; it claims nothing more, its tokens stop, and on its next contact the app wipes everything; with Android Enterprise (a work profile) the organisation's device management can wipe it too.
  • Policy: an organisation can require ephemeral mode, a work profile, a locked bootloader and a recent security patch before a phone may register (Play Integrity or key attestation), and limit its runners to its own repositories.
  • Honest limit: a phone stolen unlocked while a job runs exposes that job's working data until the screen locks or the hub cancels; the runner can stop work the moment the device leaves the owner (screen off and device not on charge/at a trusted place).

andymccall set labels feature, runner, security ·

andymccall

Andy (2026-10-24): an organisation can require that a phone runs jobs only on the corporate network and charging. Two layers:

  • Enforced by the hub (cannot be faked by the phone): the organisation's runner policy names the address ranges its network reaches the hub from; the hub gives work (claims, job tokens, secrets) only to runners whose requests come from them, checked on every claim and heartbeat. A phone elsewhere, even with a tampered app, gets nothing.
  • Checked on the phone: only while charging and on the managed corporate Wi-Fi, ideally certificate-authenticated (EAP-TLS) and pushed by the organisation's device management, so a network with the same name does not count; the runner pauses the moment either goes, and a job running when the phone leaves is cancelled and its working data wiped. With the work profile and ephemeral mode above, a runner only ever works plugged in at the office. Hub side: organisation runner policies (allowed source ranges, require charging/managed network attestation from the app, ephemeral mode) under the organisation's Settings › Runners.