[frahlg]

Why

The relay stopped on 17 October 2026, and with it the socket that carried a watch's exchange with its box (ADR 0009). A watch without its iPhone could then neither read its home nor charge the car. This is the wire that carries the exchange through FTW Cloud instead.

What

• cloudwire: x. A watch's one-shot request carries x {d}. The service sends the box x {dev, id, d} and returns the box's d in message 2. It reads neither d and keeps nothing. CapX, XDataMax (2 KiB), XAnswerWithin (5 s), XInFlight (8). Downlink and OnceMessages gain x.
• Golden vectors: testdata/cloud-once-x-vectors.json (the watch's request, the x down and up the uplink, and the answer).
• docs/protocol-cloud.md: a new section, "Exchange".
  • FTW Cloud admits x from a device with the roster's tun and role watch, so commands work with the readable copy off.
  • What the box checks again, and its limits: two sessions per watch and eight in all, 12 handshakes a minute per watch and 60 in all, 120 requests a minute, and a tenth of the tunnel budget for x. A request the box cannot answer runs nothing.
  • A restart forgets the command log, so a cmdId sent again after one can run again.
  • A watch may send loadpoint.hold alone.
• ADR 0009: a new section, "Through FTW Cloud" (proposed). It covers six changes:
  1. The exchange rides the one-shot request.
  2. The owner's phone adds its watch by its key, with the same step-up, so no code crosses the service. The code path is gone.
  3. A watch has tun in the roster.
  4. A watch reads FTW Cloud's copy, signed by the box.
  5. The exchange takes loadpoint.hold alone.
  6. A replayed message 1 ends no working session, and a restart forgets the command log.

Decisions for Fredrik

• Do you accept "Through FTW Cloud" in ADR 0009? Commands now go through FTW Cloud as ciphertext the service cannot read. The phone's commands have done the same since the one-door decision of 15 October. The box still decides everything.
• Enrolment by key instead of a watch code. feat(cloud): a watch's exchange rides FTW Cloud #1819 removes the code path.

Pairs

• Box side: feat(cloud): a watch's exchange rides FTW Cloud #1819, on master. It carries this PR's commits until this one squash-merges.
• FTW Cloud: feat(once): carry a watch's exchange to its box as x ftw-cloud#49. It pins 657f84a; move the pin to this PR's squash commit.
• Watch and phone: feat(watch): the watch on its own through FTW Cloud ftw-app#99 (replays these vectors byte for byte).

Merge this first, then srcfl/ftw-cloud#49 with its pin moved to the merge commit.

Proof

• go vet ./... and go test ./... in go/protocol: all green.
• TestFieldsMatchTheProtocolDocument holds the new x table to the code.
• internal/cloudlink and internal/appuplink on master still pass with the new Downlink. A box without the cap is sent no x.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T15:04:54.225407Z	657f84a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[frahlg]

Fredrik approved this in chat on 23 October 2026: the "Through FTW Cloud" section of ADR 0009 (all six points) and the minor bump for the watch on its own.

🤖 Generated with Claude Code