Machine connection
A bounded request, stream and close contract. It does not know whether bytes travelled through HTTPS, a private network or a relay.
Technology
The product stays stable. The plumbing can evolve.
Durable sessions, agent adapters and authenticated transports meet behind narrow, testable boundaries.
Transport is a provider, not the product.
Fleet, terminal and agent screens call one authenticated machine API. Connection strategies compete below that boundary and must prove the expected machine identity.
Mobile productFleet, terminal, agents, decisions
Authenticated Machine APIMachineId, bearer, resume, policy
HTTPS/WSSAvailable now
Private TailscaleAvailable now
Denshin Relay · IrohRelease candidate
Your machinedenshind, PTY, agents and credentials
The Relay separates reachability from payload access.
Endpoints hold payload keys while the service routes encrypted frames. Admission sees an authenticated Iroh EndpointId, validates its short lease and never receives terminal plaintext or a machine bearer.
Release candidateValidated end to end; hosted DNS and TLS rollout remains.
Enrolled deviceHolds device keys
E2E ciphertextRelay + admissionEndpointId, never payload
E2E ciphertextYour machineHolds machine keys
Four primitives carry the stack.
Durable session
The PTY survives client churn. Snapshots and ordered catch-up restore the mobile projection without taking ownership from the machine.
Agent adapter
Each provider exposes only the conversation, work, runs and decisions it can substantiate. Raw terminal access stays independent.
Security invariant
Machine identity, token domains, authority, limits and log hygiene are executable checks shared by every transport provider.
Structured views never swallow the terminal.
Adapters project useful provider context beside the PTY. They are optional modules, not a dependency of the raw session path.
One sessionSame machine, same run
Raw terminalSource of truth
Agent viewProvider-aware projection
Delivery status
Built, validating, later.
Local daemon and mobile client
Durable PTYs, Fleet, raw terminal, structured Claude Code, Codex, OpenCode and Pi surfaces.
HTTPS/WSS and private Tailscale
Verified machine connections through the authenticated API boundary.
Native Iroh and Denshin Relay
Originless enrollment, public signed bootstrap, post-auth lease promotion, distributed quotas and true relay-only encrypted RPC pass locally. Hosted DNS/TLS and operational gates remain.
Execution isolation
Container-scoped workspaces will reduce blast radius, but are not a current product guarantee.