feat: integrate E2EE remote-control foundation

[Lokesh7025]

Purpose

Create the shared E2EE integration branch for reviewed Person 2 transport, daemon-authorization, and SDK-delivery work. This PR supersedes #392 and will remain the integration PR while Person 1 develops the reviewed cryptographic implementation from origin/RC.

Fixes

N/A

Approach

RC currently contains:

• the TypeScript control-plane ticket and authenticated internal-service boundary
• the Elixir/OTP bounded opaque WebSocket relay
• role-filtered route discovery and strict device <-> daemon topology
• explicit heartbeat, half-open, slow-consumer, lease, draining, and revocation behavior
• generation-bound tickets and stale-ticket rejection
• cross-language framing and internal-contract fixtures
• durable daemon device grants, hosted/local scope intersection, terminal revocation, explicit RPC-to-scope mapping, and internal dispatcher integration behind fake E2EE
• SDK opaque durable-outbox interfaces and exact ciphertext-byte retry behavior
• the reviewed remote permission-authorization draft, without enabling remote approval

This PR does not implement or enable real PQXDH, Triple Ratchet, pairing cryptography, cryptographic replay handling, secure ratchet persistence, prekey lifecycle, attachment cryptography, S3 integration, or ordinary-session remote access.

Person 1 should branch from origin/RC, implement cryptography independently of the relay, and merge reviewed integration commits back into RC. RC will merge to main only after the staged security and integration gates pass.

How was this tested?

Passed on the integrated RC branch:

• pnpm check
  • 909 tests
  • 904 passed
  • 5 platform skips
  • 0 failures
• pnpm relay:check
  • 16 relay tests passed
  • Mix formatting and warnings-as-errors compilation passed
  • Credo passed
  • Dialyzer passed
  • dependency audit passed
• pnpm audit --audit-level high
• reuse lint
• node scripts/check-dco.ts origin/main HEAD

PR #392 also passed TypeScript build/test, relay build/test, workflow lint, CodeQL, REUSE, DCO, dependency review, lockfile audit, and Gitleaks before being integrated into RC.

Learning

The relay remains independent of cryptographic message formats. Person 1 can develop and test the endpoint cryptography against an in-memory mailbox, while RC retains opaque-byte transport, authorization, delivery, and failure semantics.

Checklist

• I reviewed the complete diff.
• I added or updated the smallest relevant test for behavior changes.
• I ran the relevant formatting, lint, type-check, test, boundary, and license checks.
• Every new file has SPDX metadata, directly or through REUSE.toml.
• Every commit has a matching DCO Signed-off-by trailer.
• UI changes include screenshots attached to the pull request, not committed to the repository. (N/A: no UI changes.)

Licenses

Resource	Source and version	License	Use
Bandit	Hex 1.12.5	MIT	Relay HTTP/WebSocket server
Plug	Hex 1.20.3	Apache-2.0	Relay HTTP boundary
WebSock Adapter	Hex 0.6.0	MIT	WebSocket upgrade adapter
Credo	Hex 1.7.12	MIT	Development-only static analysis
Dialyxir	Hex 1.4.6	Apache-2.0	Development-only type analysis
mix_audit	Hex 2.1.5	BSD-3-Clause	Development-only dependency audit

AI assistance

• Generative AI materially assisted this change. Tool and model/version: pi coding agent with Azure OpenAI gpt-5.6-sol.
• I manually reviewed, understood, and tested the generated work.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 3 package(s) with unknown licenses.
• ⚠️ 7 packages with OpenSSF Scorecard issues.

View full job summary