obol is a desk meter paired by BLE to a single Mac. Threats:

1. Anthropic Admin API key exposure. Read-only access to org usage and cost data. Leaked → attacker sees spend patterns. Cannot make inference calls or charge money.
2. BLE pairing hijack. Another device claiming to be the daemon.
3. Stolen device.
4. Firmware tamper.

Lives in macOS Keychain as service obol-admin-key. Never in config files, env vars, or shell history.

• Env vars are visible to anyone with ps -E and inherit to child processes.
• Config files get backed up to Time Machine which may sync to iCloud.
• Keychain entries are local-only and have per-app ACLs.

Set:

security add-generic-password -a "$USER" -s "obol-admin-key" -w

Rotate: revoke in Console → Settings → Admin Keys, generate new, then:

security delete-generic-password -s "obol-admin-key"
security add-generic-password -a "$USER" -s "obol-admin-key" -w
launchctl kickstart -k gui/$UID/com.obol.daemon

The key does NOT sync to iCloud Keychain.

NimBLE bonding with persisted keys. First-pair confirmation on Screen 4 via touch button. Bonding NVS survives reboots.

To clear: long-press BtnB on Status screen for 3 seconds, confirm on screen.

Device is read-only with respect to the Mac. Sends HID keystrokes (Space, Shift+Tab, Cmd+Esc) and receives usage data. No credentials, no API keys on the device. Worst case: someone sees your token burn numbers.

The Core2 for AWS has an ATECC608B secure element — not used in v1, could anchor mTLS identity for future server-pull architecture.

Source in this repo. Flash over USB-C from clean checkout. No OTA in v1.

• WiFi credentials, if you enable WiFi (v1 doesn't enable WiFi at all).
• Display itself — line of sight reveals your spend.
• Time Machine backup of the source repo is fine; no secrets in source.

Personal project. ghost@800poundgorilla.