<!doctype html><html lang="en">  <head>    <meta charset="utf-8" />    <meta name="viewport" content="width=device-width, initial-scale=1" />    <title>T3 Connect Architecture</title>    <style>      :root {        color-scheme: light;        --ink: #171717;        --muted: #62646b;        --hairline: #d8d8dd;        --panel: #ffffff;        --paper: #f5f5f2;        --blue: #1457d9;        --green: #1d7d4d;        --amber: #a65f00;        --red: #b8242c;        --violet: #6150b8;        --shadow: 0 18px 55px rgba(25, 25, 28, 0.08);      }       * {        box-sizing: border-box;      }       body {        margin: 0;        background:          linear-gradient(90deg, rgba(0, 0, 0, 0.035) 1px, transparent 1px),          linear-gradient(rgba(0, 0, 0, 0.035) 1px, transparent 1px), var(--paper);        background-size: 34px 34px;        color: var(--ink);        font-family:          ui-sans-serif,          -apple-system,          BlinkMacSystemFont,          "Segoe UI",          sans-serif;        line-height: 1.48;      }       .shell {        width: min(1540px, calc(100vw - 40px));        margin: 0 auto;        padding: 38px 0 72px;      }       header {        border-bottom: 2px solid var(--ink);        padding-bottom: 24px;        margin-bottom: 28px;      }       .eyebrow {        color: var(--blue);        font-size: 12px;        font-weight: 800;        letter-spacing: 0.08em;        text-transform: uppercase;      }       h1 {        max-width: 980px;        margin: 8px 0 12px;        font-size: clamp(34px, 5vw, 66px);        line-height: 0.98;      }       h2 {        margin: 0 0 14px;        font-size: 26px;        line-height: 1.08;      }       h3 {        margin: 22px 0 8px;        font-size: 17px;      }       p {        margin: 0 0 12px;      }       code,      .mono {        font-family:          ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", monospace;      }       code {        border-radius: 4px;        background: #f0f0ed;        padding: 1px 4px;        font-size: 0.92em;      }       .lede {        max-width: 1000px;        margin: 0;        color: var(--muted);        font-size: 18px;      }       .grid {        display: grid;        grid-template-columns: repeat(12, 1fr);        gap: 18px;      }       .panel {        grid-column: span 12;        border: 1px solid var(--hairline);        border-radius: 10px;        background: var(--panel);        box-shadow: var(--shadow);        padding: 22px;      }       .half {        grid-column: span 6;      }       .callout {        border-left: 5px solid var(--blue);        background: #eef4ff;        padding: 14px 16px;        margin-top: 14px;      }       .callout.warning {        border-left-color: var(--amber);        background: #fff6e6;      }       .badge-row {        display: flex;        flex-wrap: wrap;        gap: 8px;        margin-top: 14px;      }       .badge {        border: 1px solid var(--hairline);        border-radius: 999px;        background: #fff;        padding: 5px 9px;        font-size: 12px;        font-weight: 700;      }       .badge.user {        border-color: rgba(20, 87, 217, 0.3);        color: var(--blue);      }       .badge.env {        border-color: rgba(29, 125, 77, 0.3);        color: var(--green);      }       .badge.local {        border-color: rgba(166, 95, 0, 0.35);        color: var(--amber);      }       .diagram {        overflow-x: auto;        margin: 12px 0 0;        border: 1px solid var(--hairline);        border-radius: 8px;        background: #fbfbf8;        color: var(--ink);        padding: 18px;      }       .diagram svg {        display: block;        width: auto !important;        min-width: 100%;        max-width: none !important;        height: auto;        margin: 0 auto;      }       table {        width: 100%;        border-collapse: collapse;        font-size: 14px;      }       th,      td {        border-bottom: 1px solid var(--hairline);        padding: 11px 9px;        text-align: left;        vertical-align: top;      }       th {        color: var(--muted);        font-size: 12px;        letter-spacing: 0.05em;        text-transform: uppercase;      }       ul {        margin: 8px 0 0;        padding-left: 20px;      }       li + li {        margin-top: 6px;      }       .flow {        display: grid;        gap: 10px;        margin-top: 12px;      }       .step {        border: 1px solid var(--hairline);        border-left: 5px solid var(--green);        border-radius: 8px;        background: #fff;        padding: 12px 14px;      }       .step strong {        display: block;        margin-bottom: 3px;      }       .source-list a {        color: var(--blue);        font-weight: 700;      }       @media (max-width: 860px) {        .half {          grid-column: span 12;        }         .shell {          width: min(100vw - 24px, 1540px);          padding-top: 24px;        }      }    </style>  </head>  <body>    <main class="shell">      <header>        <div class="eyebrow">Implemented architecture</div>        <h1>T3 Connect Control Plane and Managed Endpoint Flow</h1>        <p class="lede">          T3 Connect links a locally authorized T3 environment to a signed-in cloud user, provisions          a managed HTTPS/WSS endpoint for that environment, and brokers proof-bound remote          connections. The local environment remains the authority that issues environment access          credentials. The hosted relay stores links, reconciles managed endpoint resources,          validates signed proofs, and delivers agent-activity notifications.        </p>        <div class="badge-row">          <span class="badge user">Client -> Relay: Clerk bearer or relay DPoP</span>          <span class="badge env">Relay -> Environment: relay-signed health and mint proofs</span>          <span class="badge env"            >Environment -> Relay: environment bearer plus signed activity proof</span          >          <span class="badge local">Client -> Environment: environment access token plus DPoP</span>        </div>      </header>       <section class="grid" aria-label="Architecture summary">        <article class="panel half">          <h2>Security Invariant</h2>          <p>            A cloud identity is not an environment login. Remote access requires all of the            following:          </p>          <ul>            <li>a Clerk-authenticated T3 Connect user;</li>            <li>an active relay link for that user and environment;</li>            <li>a DPoP proof key held by the remote client;</li>            <li>a relay-signed mint request accepted by the linked local environment; and</li>            <li>an environment-issued credential bound to the remote client's DPoP thumbprint.</li>          </ul>          <div class="callout">            The relay cannot mint an environment access token by itself. It can only ask the local            environment to mint a short-lived bootstrap credential for an authorized cloud user.          </div>          <p>During an honest connection flow, the relay cannot act as the remote client:</p>          <ul>            <li>              Normal environment API traffic goes directly from the remote client through the              managed endpoint. The relay does not receive the resulting environment access token.            </li>            <li>              The one-time bootstrap credential and resulting environment access token are bound to              the remote client's DPoP public-key thumbprint. Redeeming or using them requires              request proofs signed by the corresponding private key, which stays on the client.            </li>            <li>              Relay-signed health and mint proofs are short-lived, audience-bound, scoped, and              replay-guarded. They are accepted only by the narrow cloud endpoints, not as normal              environment API credentials.            </li>            <li>              Environment health and mint responses are signed by the linked environment and bound              to the request nonce, so a different process behind the tunnel cannot impersonate the              linked environment.            </li>          </ul>          <div class="callout warning">            The hosted relay remains a trusted mint broker: it holds the cloud-mint signing key.            DPoP prevents credential reuse by the relay or tunnel transport during an honest flow,            but it does not make compromise of the relay signing authority harmless.          </div>        </article>         <article class="panel half">          <h2>Product Boundaries</h2>          <p>            The generic local connector is called the <strong>relay client</strong>. The current            implementation layer uses <code>cloudflared</code>, but that is an internal transport            detail rather than the product contract.          </p>          <ul>            <li>              The relay Worker owns cloud links, managed endpoint allocations, and notifications.            </li>            <li>              The environment server owns local sessions, environment keys, and access tokens.            </li>            <li>The relay client exposes only the environment's loopback HTTP server.</li>            <li>              Web and mobile clients connect directly to the managed environment endpoint after              bootstrap.            </li>          </ul>        </article>      </section>       <section class="panel" aria-label="Topology">        <h2>Current Topology</h2>        <pre class="diagram mermaid">flowchart LR  subgraph Clients["User-facing clients"]    Web["Desktop / hosted web UI"]    Mobile["Mobile app"]    CLI["Headless CLI"]  end   Clerk["Clerk<br/>user identity and OAuth"]   subgraph Relay["T3 Code Relay on Cloudflare"]    Worker["Relay Worker<br/>HTTP API"]    Queue["APNs delivery queue<br/>with dead-letter queue"]    Hyperdrive["Hyperdrive"]    CF["Cloudflare tunnel + DNS APIs"]  end   DB["PlanetScale Postgres<br/>prod database + stage branches"]  APNs["Apple Push Notification service"]  Traces["Axiom OTLP traces"]   subgraph Local["Linked T3 environment"]    Env["Environment server<br/>local auth authority"]    RelayClient["Relay client<br/>cloudflared implementation"]    Secrets["Server secret store<br/>keys + relay config"]  end   Endpoint["Managed HTTPS/WSS endpoint"]   Web -->|"Clerk bearer / relay DPoP"| Worker  Mobile -->|"Clerk bearer / relay DPoP"| Worker  CLI -->|"Clerk OAuth bearer"| Worker  Web --> Clerk  Mobile --> Clerk  CLI -->|"PKCE authorization code flow"| Clerk  Worker --> Hyperdrive --> DB  Worker --> Traces  Worker --> CF  Worker --> Queue --> APNs  Worker --> Endpoint  Endpoint --> RelayClient -->|"http://127.0.0.1:port"| Env  Env --> Secrets  Web -->|"environment token + DPoP<br/>HTTPS / WSS"| Endpoint  Mobile -->|"environment token + DPoP<br/>HTTPS / WSS"| Endpoint  Env -->|"environment bearer + signed activity proof"| Worker        </pre>      </section>       <section class="panel" aria-label="Authentication matrix">        <h2>Authentication and Transport Matrix</h2>        <table>          <thead>            <tr>              <th>Boundary</th>              <th>Transport</th>              <th>Authentication</th>              <th>Purpose</th>            </tr>          </thead>          <tbody>            <tr>              <td>Web or mobile -> relay link management</td>              <td>HTTPS</td>              <td>Clerk session-template bearer token</td>              <td>Create a link challenge, submit an environment proof, list links, or unlink.</td>            </tr>            <tr>              <td>CLI -> relay link management</td>              <td>HTTPS</td>              <td>Clerk OAuth access token obtained with PKCE</td>              <td>Reconcile the desired headless cloud link when the server starts.</td>            </tr>            <tr>              <td>Web or mobile -> relay protected client endpoints</td>              <td>HTTPS</td>              <td>Relay-issued DPoP token plus per-request DPoP proof</td>              <td>                Check environment status, request a remote connection, and register mobile devices.              </td>            </tr>            <tr>              <td>Relay -> managed environment endpoint</td>              <td>HTTPS over the managed tunnel</td>              <td>Short-lived relay-signed JWT request proof</td>              <td>                Request a signed health response or ask the local environment to mint a credential.              </td>            </tr>            <tr>              <td>Environment -> relay activity publication</td>              <td>HTTPS</td>              <td>Relay-issued environment bearer credential plus environment-signed JWT proof</td>              <td>                Publish redacted agent-activity state for push notifications and Live Activities.              </td>            </tr>            <tr>              <td>Remote client -> environment</td>              <td>HTTPS and WSS over the managed tunnel</td>              <td>Environment-issued access token bound to the client DPoP key</td>              <td>Use the normal environment HTTP APIs and request a one-time WebSocket ticket.</td>            </tr>          </tbody>        </table>      </section>       <section class="panel" aria-label="Credential ownership">        <h2>Credential Ownership</h2>        <table>          <thead>            <tr>              <th>Credential</th>              <th>Created by</th>              <th>Stored by</th>              <th>Use</th>            </tr>          </thead>          <tbody>            <tr>              <td>Clerk session-template JWT</td>              <td>Clerk</td>              <td>Web or mobile client</td>              <td>                Authenticate cloud-user relay requests and bootstrap relay DPoP token exchange.              </td>            </tr>            <tr>              <td>CLI OAuth access and refresh token</td>              <td>Clerk OAuth</td>              <td>Local server secret store</td>              <td>Authorize headless CLI link reconciliation.</td>            </tr>            <tr>              <td>Environment Ed25519 key pair</td>              <td>Local environment server</td>              <td>Local server secret store</td>              <td>                Sign link proofs, health responses, mint responses, and activity publication proofs.              </td>            </tr>            <tr>              <td>Relay cloud-mint key pair</td>              <td>Relay deployment</td>              <td>Private key in relay Worker config; public key installed into the environment</td>              <td>Sign relay-to-environment health and mint requests.</td>            </tr>            <tr>              <td>Relay environment bearer credential</td>              <td>Relay</td>              <td>Hashed in relay Postgres; plaintext in local server secret store</td>              <td>Authenticate environment-to-relay agent-activity publication.</td>            </tr>            <tr>              <td>Relay DPoP access token</td>              <td>Relay</td>

Lines 1–500 of 1160. Load more