Safe first step
Send signals
Use a sender DSN for one-way encrypted alerts. It can send into one pipe only; it cannot read history, connect as an agent, or execute commands.
echo "deploy failed" | nerve sendEnd-to-end encrypted ops pipe
Encrypted signals. Signed actions.
Send encrypted CI/CD and server alerts to iPhone. Add the agent when you want signed, bounded actions on infrastructure you control.
Advanced
Run agent
Connect a machine you control when you want signed, bounded actions. The agent is a remote action runner, not SSH or a general-purpose terminal.
nerve-agent -server api.nerve.ink:443 -token TOKENRelay sees ciphertext. Signal and command payloads are encrypted before they reach Nerve.
Sender cannot read. A leaked sender DSN can post signals, not decrypt old content.
Commands are signed. Agent execution requires signed command payloads from the iOS identity.