bastion 0.56.0

README.md

@@ -248,6 +248,10 @@ Each point in full: [docs/security-model.md](docs/security-model.md); the link a
   connection is accepted. ([tunnel](docs/lanes.md#tunnel))
 - **A Host on this machine gets the same walls**: mutual TLS against the CA
   pinned at pairing, and the bearer on every lane. ([page](docs/host-on-this-machine.md))
+- **A Host with no platform reaches your model servers by name, never by
+  address**: it names `ollama`, `llm` or `pii`, and the bastion reaches the
+  server set on this machine for it, through the forwards' filter, only when
+  that address is this machine. ([page](docs/host-on-this-machine.md#the-model-servers-on-this-machine))
 - **Scoped tunnel.** The WireGuard peer's only allowed address is the paired
   host's single tunnel address. ([tunnel](docs/lanes.md#tunnel))
 - **No MCP endpoint.** Nothing on this machine drives the host.
@@ -269,8 +273,8 @@ Each point in full: [docs/security-model.md](docs/security-model.md); the link a
 - **Egress for someone else reaches the public internet, never this
   machine**: a coder run's proxy and an anchored machine's egress lane refuse
   internal addresses and this machine's own (a coder run reaches a LAN host
-  you named). A local machine's egress lane refuses this machine and keeps
-  your LAN. An address that reaches this machine only through a 1:1 NAT is
+  you named). A local machine's egress lane refuses this machine and your
+  LAN too; your own machines are reached through their approved lanes. An address that reaches this machine only through a 1:1 NAT is
   not covered. ([full text](docs/security-model.md))
 - **A terminal is checked here and logged.** On a local machine it opens when
   the host asks; on an anchored one each needs an approval for that session;