Fleet trust, stage 3: a directory the relay cannot read, and a browser that pairs once - #41

Merged

karngyan merged 29 commits into

mainfrom

feat/fleet-directory

Aug 10, 2026

Commits on Aug 10, 2026

feat(relay): the fleet directory — blobs the Worker keeps and cannot read

karngyan
and
claude
committed
486b8d0
feat(fleet): the daemon side of the directory — publish, verify, and a kill switch that crosses machines

karngyan
and
claude
committed
d382196
feat(pair): the pairing link carries the fleet public key

karngyan
and
claude
committed
754faa3
feat(web): the browser reads fleet certificates, and message A carries one

karngyan
and
claude
committed
7726640
feat(web): pin the fleet key at pairing, from the link and nowhere else

karngyan
and
claude
committed
5a26c33
feat(web): machines from the fleet directory, not only from ceremonies

karngyan
and
claude
committed
b9f7c56
docs(relay): the fleet directory, what a full one costs, and the flag day

karngyan
and
claude
committed
ae71ebb
feat(relay): a way out of a full directory — DELETE /directory and `flue relay reset`

karngyan
and
claude
committed
23bf47f
docs(relay): say what a 507 actually does to a revocation

karngyan
and
claude
committed
358c367
fix(cloudflare): stop the migration tag read failing open, and repair a precondition properly

karngyan
and
claude
committed
75c460b
feat(relay): warn before the fleet directory fills, on both status surfaces

karngyan
and
claude
committed
342e0d3
docs(spec): name the one exception to "availability is the relay's only power"

karngyan
and
claude
committed
d62846f
test(relaydeploy): make the wrangler.jsonc twin a test, not a promise

karngyan
and
claude
committed
ef99695
fix(cloudflare): say something when the relay is from a newer flue

karngyan
and
claude
committed
7f78603
docs(web): say why the cert encoders disagree about iat, and pin that the decoders do not

karngyan
and
claude
committed
6643690
feat(relay): a tested socket cap, a conditional GET, and a rate-rule comment that is true

karngyan
and
claude
committed
9eebd16
fix(daemon): let a loopback tab reach the relay its own daemon dials

karngyan
and
claude
committed
0a3f9ad
feat(fleet): hand a device its certificate directly, at pairing and on every welcome

karngyan
and
claude
committed
1f60d13
feat(fleet): take device certificates out of the relay's public directory

karngyan
and
claude
committed
50e5ff5
fix(relay): stop the status surfaces counting devices the directory no longer lists

karngyan
and
claude
committed
9d624c8
docs(relay): refresh the `flue relay status` example for what the fleet line now says

karngyan
and
claude
committed
f630150
fix(fleet): stop the pairing ceremony publishing the device cert

karngyan
and
claude
committed
a4bd037
fix(relay): stop blaming an older flue for a device cert in the directory

karngyan
and
claude
committed
13815e9
fix(fleet): let a re-supplied certificate unlock its machines in the same session

karngyan
and
claude
committed
a1d8e8e
docs(fleet): say that the certificate's second chance is a relay-tab property

karngyan
and
claude
committed
c9dc0f6
test(web): cover the certificate the pairing answer carries

karngyan
and
claude
committed
4ce9f66
fix(daemon): resolve a welcome's fleet certificate by key, not by device id

karngyan
and
claude
committed
60a2218
docs(spec): rewrite the pruning refusal around the reason that is true

karngyan
and
claude
committed
bc54326
docs(fleet): retire the comments that still publish device certs, and say what privacy changed

karngyan
and
claude
committed
1df77dd

Navigation Menu

Uh oh!

Fleet trust, stage 3: a directory the relay cannot read, and a browser that pairs once - #41

Fleet trust, stage 3: a directory the relay cannot read, and a browser that pairs once#41
karngyan merged 29 commits into
mainfrom
feat/fleet-directory

Commits on Aug 10, 2026

feat(relay): the fleet directory — blobs the Worker keeps and cannot read

feat(fleet): the daemon side of the directory — publish, verify, and a kill switch that crosses machines

feat(pair): the pairing link carries the fleet public key

feat(web): the browser reads fleet certificates, and message A carries one

feat(web): pin the fleet key at pairing, from the link and nowhere else

feat(web): machines from the fleet directory, not only from ceremonies

docs(relay): the fleet directory, what a full one costs, and the flag day

feat(relay): a way out of a full directory — DELETE /directory and `flue relay reset`

docs(relay): say what a 507 actually does to a revocation

fix(cloudflare): stop the migration tag read failing open, and repair a precondition properly

feat(relay): warn before the fleet directory fills, on both status surfaces

docs(spec): name the one exception to "availability is the relay's only power"

test(relaydeploy): make the wrangler.jsonc twin a test, not a promise

fix(cloudflare): say something when the relay is from a newer flue

docs(web): say why the cert encoders disagree about iat, and pin that the decoders do not

feat(relay): a tested socket cap, a conditional GET, and a rate-rule comment that is true

fix(daemon): let a loopback tab reach the relay its own daemon dials

feat(fleet): hand a device its certificate directly, at pairing and on every welcome

feat(fleet): take device certificates out of the relay's public directory

fix(relay): stop the status surfaces counting devices the directory no longer lists

docs(relay): refresh the `flue relay status` example for what the fleet line now says

fix(fleet): stop the pairing ceremony publishing the device cert

fix(relay): stop blaming an older flue for a device cert in the directory

fix(fleet): let a re-supplied certificate unlock its machines in the same session

docs(fleet): say that the certificate's second chance is a relay-tab property

test(web): cover the certificate the pairing answer carries

fix(daemon): resolve a welcome's fleet certificate by key, not by device id

docs(spec): rewrite the pruning refusal around the reason that is true

docs(fleet): retire the comments that still publish device certs, and say what privacy changed