[blackkcold]

Android Unified Peer + Relay Lite (work in progress)

Implemented on this PR (not yet production-accepted)

• Signed node/admin origin trust mapping (separate SPKI pin sets, fail closed)
• LAN service-owned NSD discovery, serialized resolver, symmetric v2 discovery, Android 17 LAN permission UX
• Peer relationship v2 with independently signed directional read/send grants, v1 read compatibility
• Reciprocal Peer RPC over LAN and WebRTC (v1 remains asymmetrical)
• Relay Lite E2EE offline envelope, bounded SQLite ciphertext mailbox, target-scoped pull/ACK and peer revocation purge
• Durable ciphertext resend with single logical request ID, asynchronous request/response recovery
• Native Relay Lite host/peer consent/inbox/fallback and route diagnostics
• Offline history/event response budgets and retry-ID persistence
• Idle mailbox backoff
• Added unit and Android instrumented tests

Acceptance blockers (do not merge/release prematurely)

• CI/CodeQL/Android sandbox all green on the latest commit (not old checks)
• Two real Android devices: direct LAN state/history, reciprocal SMS rights, reconnect after Wi-Fi changes
• Real carrier-to-carrier WebRTC signaling and restrictive NAT TURN fallback
• User-ready publicly reachable signaling/TURN deployment, trusted production pins, TLS/certificate rotation (there is no production default endpoint in public build)
• Relay Lite A -> C -> B store-and-forward and reverse-result recovery on three real devices with Wi-Fi/mobile handoff, offline/delayed delivery
• Doze/force-stop and battery testing; no unconditional background reachability claim
• Security review of authorization, migrations, queue DoS/rate limits, replay handling and message retention; signed Dev acceptance
• Stable/main promotion only after the above acceptance gates

Status: Draft remains intentional. The final product cannot claim arbitrary-network or zero-deployment reliability without an operating infrastructure and real-network acceptance. PR commits preserve incremental progress.