[Jinwoo-H]

Summary

Adds Orca Relay end to end while preserving account-free LAN/Tailscale pairing as the preferred path:

• desktop auth lifecycle, scoped relay-token exchange integration, director assignment, host proof/control, data transports, origin-aware drain/rebind, revoke durability, and thin Mobile settings status UI;
• additive pairing offers and E2EE v2 with transcript binding, directional keys, session/counter framing, bounded queues, and the exact legacy direct path for version skew;
• mobile pairing races, crash-safe credential reconciliation, configured-director recovery, native credential storage, stable logical RPC cutover, endpoint hysteresis, and relay E2EE connect/migration;
• shared strict protocol fixtures, recovery matrices, and adversarial integration coverage.

Relay remains free but requires desktop Orca sign-in. The phone does not sign in, there is no rollout flag, and older desktop/mobile counterparts continue through the additive offer and legacy direct path.

Review-only area PRs (do not merge independently):

• Desktop transport/broker: Review: Orca Relay desktop transport and broker #8526
• Desktop sign-in UI: Review: Orca Relay desktop sign-in status UI #8529
• Mobile endpoints/racing: Review: Orca Relay mobile pairing endpoints and racing #8530
• Mobile relay connect/migration: Review: Orca Relay mobile logical connect and migration #8531

This combined PR is the sole merge candidate.

Screenshots

The settings UI is intentionally thin pending the separately designed final UI. No screenshot attached yet.

Testing

• pnpm lint
• pnpm typecheck
• pnpm test (the full unsupported-Node-26 run passed 2,766 files and exposed 10 failures; under required Node 24, nine passed in isolation and the one branch-caused stale assertion was corrected and passed)
• pnpm build
• Added adversarial protocol, E2EE, auth lifecycle, broker, pairing/recovery, endpoint, migration, cleanup, UI, and real local-relay integration tests

Supported Node 24 validation:

• 309 focused desktop/shared files: 3,022 passing tests, 2 files / 4 tests skipped;
• all 224 mobile files: 1,571 passing tests, 2 skipped;
• max-lines ratchet, standalone mobile typecheck, mobile lint, and mobile format checks passed;
• each of the 10 files that failed under Node 26 was rerun independently; all pass after correcting the migrated connection-count assertion.

AI Review Report

Adversarial review focused on the protocol state machines, close-code recovery, E2EE downgrade/replay/reflection/counter handling, auth epoch races, global credential-install idempotency, invite fallback, generation fencing, origin ownership during drain, crash recovery, logical-session cutover, and bounded resource behavior. It found and corrected stale async ownership, relay-origin drain/rebind, mobile journal/reconciliation, configured-director recovery-matrix, settings-test isolation, and runtime integration-test seam issues.

Cross-platform review preserved runtime path APIs and existing platform abstractions; the thin UI adds no platform-specific shortcut behavior. Relay transports work for local, native/WSL, and SSH-hosted desktop runtimes because the desktop initiates outbound cloud connections and mobile RPC wiring remains host-runtime scoped.

Security Audit

Reviewed strict/bounded protocol parsing, query-free bearer transport, issuer/audience/purpose pinning, host key-possession proof, relayHostId/device binding, E2EE transcript confirmation before device authorization, nonce/counter uniqueness, queue limits, credential redaction, SecureStore use, IPC ownership, stale-generation fencing, durable revoke ordering, and direct/relay authorization-mode reconciliation. Broad auth-plane bearer tokens are never accepted by the relay, and the phone supplies no authoritative identity/version fields.

Cloud service and infrastructure changes are tracked and merged separately in stablyai/orca-cloud.

Notes

The four stacked draft PRs exist only to make area review manageable. Review this PR for the integrated merge.

Remaining rollout gates are operational rather than hidden behind flags: public stamped-cell DNS/certificates and live migration, aggregate auth/cell load and soaks, game days, released-counterpart version skew, physical LTE/NAT latency, mobile-to-desktop-to-SSH acceptance, and production launch criteria. These must be completed before public launch even if code review lands earlier.

Made with Orca 🐋

[Jinwoo-H]

Implementation checkpoint (2026-07-13)

Live-path tracing found and fixed one Phase 3 gap before served acceptance: native direct-only profiles bypassed endpoint lifecycle ownership, so the specified automatic existing-pair relay upgrade could not run. Commit b2c61b7fd adds a crash-durable direct-upgrade journal/controller, authoritative committed/not-found reconciliation, method_not_found compatibility, foreground/reconnect retry, durable credential-before-overlay publication, host-removal fencing/cleanup, and handoff to the relay endpoint supervisor.

Validation under Node 24.18.0:

• 19 focused upgrade/controller/supervisor/host-store tests
• root and mobile pnpm typecheck
• full mobile oxlint + oxfmt check
• max-lines ratchet
• full mobile suite: 227 files passed, 1,583 tests passed, 2 skipped

Production infrastructure is still admission-disabled. Cloud PR #66 corrected disabled-source read-only preflight; three production preflight runs targeted c1/c2/c3 and passed exact-origin TLS/readiness, runtime identity/digest, fresh heartbeat, zero-work, and survivor checks without mutation. Served simulator relay evidence will follow after the one-time staging OAuth credential fill. This PR remains draft and must not be merged yet.