diff --git a/README.md b/README.md
index 30b7da0..aed4a6e 100644
--- a/README.md
+++ b/README.md
@@ -229,7 +229,6 @@ source file. It is **not currently run in CI**, and 12 files exceed the hard lim
 
 **Next**
 - Enforce task permission and argument provenance (both still in shadow, gathering evidence).
-- Route microVM missions' model calls through the LLM proxy too, so no guest holds a provider key.
 - Evidence the remaining team templates (4 of 12 still need a target stack: mobile, gpu, threejs, and
   `insight_research`).
 - A dedicated judge key, so no other consumer of a shared provider plan can starve the judge.
@@ -260,9 +259,10 @@ structures, never gives an agent more reach than its sandbox. What that means to
   container holds a per-mission token, Claude Code's base URL points at the server's proxy on an
   unpublished port, and the proxy adds the real credential — honouring the token only while its mission
   is running. Behind that, delivery refuses to push any change containing a server key, and every
-  recorded event, judge verdict and judge input is redacted. MicroVM missions still receive their
-  backend's key in the guest, behind the egress allow-list. The server reaches Docker through an
-  allow-listed socket proxy.
+  recorded event, judge verdict and judge input is redacted. **MicroVM guests hold no provider key
+  either** (node daemon 0.5.0+): the guest's CLI talks to its own loopback, fcagent pipes that to the
+  node, and the node relays it to the proxy on the server's tailnet-only port — no key on the node or in
+  the guest. The server reaches Docker through an allow-listed socket proxy.
 - The gate is a guardrail against accidents and obvious exfiltration, not a boundary against a
   determined agent (indirection defeats string matching). The boundaries are the VM, the network policy
   and the broker.