Register a machine in the console and you get a claim — a code good once, for 24 hours. The machine trades it for a bearer token on first start.
The distinction that matters: the token comes into existence on the machine. It is written with restrictive permissions, and the console keeps only its hash. A deploy script left in a Downloads folder is worthless by tomorrow.
The installer is generated, not run
Type your machine names in and the console writes a script that stages the release, installs the service, places the credential, starts it, and reads the log back until each machine confirms it joined.
You run it. The console does not, and cannot.
Certificate pinning on first contact
The console reads the certificate it actually serves and writes its fingerprint into the script. The machine pins redemption to exactly that certificate — and deliberately ignores the insecure-TLS escape hatch while doing so, because the one exchange you cannot afford to have intercepted is the one that hands out the credential.
Rolling a credential
Re-credential replaces a machine’s token with no downtime: one restart, and the old token dies the first time the new one connects.
Upgrades that roll themselves back
The console shows which machines are behind and upgrades them in a batch. Each swaps only its executable, restarts, and restores the previous binary if the service does not come back up. The release is served by the console over the same pinned TLS and checksum-verified on the machine before it is unpacked.