DEVELOPMENT DOCUMENTATION / ARCHITECTURE

An outbound connection with scoped authority.

The relay connects a consumer to a specific enrolled device and service. Authorization and local export policy both constrain what can happen.

Authorized consumer
        | HTTPS or filesystem WebSocket
        v
Relay ingress -- private mTLS HTTP/3 --> owning relay
        |                                  |
        +----- Redis authority catalog ----+
                                           ^
                          outbound mTLS WebSockets
                                           |
                              Enrolled device client
                              /     |      |      \
                            MCP    files   ACP    CUA

Three transport roles

Permissions are not implied by connectivity

Authority is scoped by tenant, principal, device, service and permitted operations. Local configuration defines exports. A connected computer is not an unrestricted remote desktop or shell.

Two sockets in steady state

Each device uses one control and one data socket. Ordered data-socket rotation permits a bounded temporary third socket while old streams drain. Transport acknowledgements do not prove an application side effect completed.

State and recovery

Redis is the authoritative catalog and coordination store. Process-local sockets and in-flight work are ephemeral. The supported coordination profile uses one authoritative Redis primary; replication is not a promise of automatic, lossless failover. Recovery must reconcile revocations and fence old ownership.

Trust boundary

Private keys stay outside the catalog. Diagnostics should expose identifiers, phases and counters, not payloads or credentials. Never automatically replay an ambiguous click, write or agent prompt after losing its outcome.