igneum-labs 1065b81d05 relay: three auth tiers, signed run tasks, machine secrets, retention; clients on headers; TZ=UTC and curl -K checks (X23 X24 X25 X26 X27 X28 X29 G13 G14)

Relay (X23, X27): the intake key is its own tier (upload and file drops only, RELAY_INTAKE_COMPAT=0 closes it);
a run task needs an Ed25519 signature by the Mac run key over {to, nonce, body sha256, flags} (RELAY_RUN_PUB,
401 without) and an HMAC tag with the target's machine secret that the agent verifies before anything runs;
results and registration are bound to the machine the secret proves (403 on a forged from).
X24: every client and Mac tool sends x-relay-token as a header to /api/relay?fn=; the path token stays for the
phone page only. X25: the agent arms the logon task only for a restart a task asked for and disarms on start
and exit. X26: 30-day retention with blob deletion, feed capped at 100, the dl base as RELAY_DL_BASE held by the
agent, never in a body. X28: GET inbox never acks (POST inbox does), RELAY-REBOOT on its own line and only with a
reboot flag, 120/min and 10 failed auths/min per IP, no username or folder on register, WSL sudo scoped to
apt-get and dpkg with SETENV, no password on a command line. X29: the intake key reaches curl through -K in
upload.sh and both upload-log.bat; tools/ci/curl-header-check.sh fails the class. G14: TZ=UTC in ship-app.mjs
and publish-jobs.sh; tools/ci/commit-tz-check.sh fails the class; history-rewrite.md names the .old-2026-10-05
files as the values in the history. The handler moved to relay/lib/handler.mjs with injected sql and blobs
(relay/lib/blob.mjs holds @vercel/blob) so relay/test/handler.test.mjs drives it without a database:
47 tests across 6 suites, all green.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

2026-10-05 18:46:13 +00:00

2.7 KiB

Raw Blame History

Igneum relay: standing instruction for the Claude Code session on this PC

the project lead's Mac and this PC talk through the Igneum relay (relay.igneum.network). You never need Gmail, a USB stick or the project lead to carry text or files. The relay clients live next to this file (the folder you unzipped igneum-relay-clients.zip into). Everything below runs in cmd or PowerShell from that folder.

Four commands

You want to	Type
See what the Mac has queued for you (and mark it read)	`send.bat inbox`
Report back (what you did, what broke, the numbers)	`send.bat result "<text>"`
Send a file (log, screenshot, zip, up to 50 MB)	`send.bat <path>`
Fetch an item or its file by id	`send.bat get <id>`

Also: send.bat "<text>" posts a plain note, send.bat peek reads without marking, send.bat done <id> closes a task. Add -TaskId <id> to a result so it links to the task it answers, -Title "..." for a headline, -To Mac to address one machine.

The loop you follow

At the start of every session, and whenever the project lead says "check the relay": run send.bat inbox. Each item is a task from the Mac: a title, a body, sometimes a file. Do what it says.
When a task is done or blocked: send.bat result "<what happened, exit codes, paths, the numbers>" -TaskId <id>. Keep it factual. Attach logs with send.bat <logfile> -TaskId <id> rather than pasting hundreds of lines.
Close it: send.bat done <id>.
Nothing waiting? Say so and carry on with what the project lead asked for locally.

The agent

igneum-agent.bat is a separate, automatic runner. the project lead double-clicks it once (it asks for administrator rights once) and leaves the window open. From then on the Mac queues scripts (run tasks) that the agent executes by itself, posts the output as result items and reboots the PC when a script asks for it. Do not stop that window. Do not run run tasks yourself; send.bat inbox only shows the task items meant for you. If the agent window is closed, tell the project lead and ask him to start igneum-agent.bat again.

Rules

The URL, key and token baked into send.ps1 and igneum-agent.ps1, and machine-secret.txt beside them, are the secret. Never paste them into chat, a commit, a screenshot or another machine. machine-secret.txt is what makes a result count as this PC's (the relay refuses a result from a bound machine without it) and what lets the agent run a signed task.
Never edit send.ps1 or igneum-agent.ps1. If they break, report it with send.bat result and the project lead ships a new zip.
Copy law applies to results too: short sentences, numbers in tables, no em dashes.

2.7 KiB Raw Blame History