Repository navigation
Conversation
Signed-off-by: Fredrik Ahlgren <fredrik@sourceful-labs.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
miravoss26
left a comment
miravoss26
left a comment
There was a problem hiding this comment.
Removes the dead relay path (exchange.go, deadman.go, the old appuplink client) now that app sessions run through the existing FTW Cloud tunnel, and re-points the software-identity route lookup from relay.ftw.energy to cloud.ftw.energy — the host sessions already use, not a new destination. Tests follow the rename (tunnel/cloud terminology) plus one new assertion that the route lookup actually hits the new host.
Security screen: no new dependencies (no go.mod/go.sum touched), no secrets in the diff, no new network destination, no authz changes — the caller-grant checks in appproto/handler.go are untouched in substance. The deletions are large but match the stated scope (#1687 already stopped opening the relay socket; this is the follow-through).
One thing worth a human glance: mergeable: CONFLICTING against main — probably just needs a rebase before merge, nothing in the diff itself looks like the source of a conflict.
Safe to merge from my read, once rebased.
The relay stopped on 17 October 2026, and with it the socket that carried
a watch's exchange with its box (ADR 0009). This is the wire that carries
it through FTW Cloud instead: a watch's one-shot request carries x {d}, the
service sends the box x {dev, id, d}, and the box answers under the same dev
and id. The service reads neither d and keeps nothing after the answer.
- MsgX, CapX, X, AppX, XDataMax, MaxXFrame, XAnswerWithin, XInFlight.
- Downlink and OnceMessages gain x; the allowlist lists x unheaded.
- Golden vectors: testdata/cloud-once-x-vectors.json.
- protocol-cloud.md "Exchange", and ADR 0009 "Through FTW Cloud"
(proposed): the phone adds its watch by key, and a watch has tun.
The box's half is the paired PR stacked on #1691; srcfl/ftw-cloud and
srcfl/ftw-app pin this commit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(cloudwire): x carries a watch's exchange through FTW Cloud
The relay stopped on 17 October 2026, and with it the socket that carried
a watch's exchange with its box (ADR 0009). This is the wire that carries
it through FTW Cloud instead: a watch's one-shot request carries x {d}, the
service sends the box x {dev, id, d}, and the box answers under the same dev
and id. The service reads neither d and keeps nothing after the answer.
- MsgX, CapX, X, AppX, XDataMax, MaxXFrame, XAnswerWithin, XInFlight.
- Downlink and OnceMessages gain x; the allowlist lists x unheaded.
- Golden vectors: testdata/cloud-once-x-vectors.json.
- protocol-cloud.md "Exchange", and ADR 0009 "Through FTW Cloud"
(proposed): the phone adds its watch by key, and a watch has tun.
The box's half is the paired PR stacked on #1691; srcfl/ftw-cloud and
srcfl/ftw-app pin this commit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chore(changeset): x in FTW Cloud's protocol
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(cloud): the exchange's limits at the box, a restart, and the watch's one op
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(adr): Fredrik accepted Through FTW Cloud on 23 October 2026
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Core v0.147.0 stopped opening the Frankfurt relay socket in #1687, but the relay client, retry/rotation code, HTTP deadman client and Watch exchange still remained in the source. Software identity also still resolved the retired relay host when asking the kernel which physical interface to use.
This removes those retired paths and uses
cloud.ftw.energyfor that route lookup. App sessions keep the existing Cloud tunnel and Noise handshake. The startup log now says the app link is ready through Cloud, rather than claiming an established relay connection. Stored identity files and keys are unchanged by this patch; route ambiguity and interface checks still fail closed.Relay and exchange fixtures are removed. The command retry and in-flight API revocation tests now run through the Cloud tunnel; the existing tunnel tests still cover pairing, forged device IDs, replay, revocation and live updates. The identity regression fails before the host change and passes afterward, including shuffled IPv4/IPv6 answers and physical-interface checks.
Validation: full
make verifyand race tests forappproto,appuplinkandgatewayidentity. No box update, restart or release was performed. Target-box preservation and startup checks belong to the next beta trial.The older overlapping #1633 is explicitly paused in favor of the existing Cloud tunnel. This follows the owner's instruction to remove the remaining relay code and adds no replacement relay or fallback.