Authorized DevKit connectivity

ICE Peer Pairing through Kerrigan

The cloud coordinates authorization and signaling. Peer traffic takes the best available path: direct UDP first, then TURN relay when needed.

ICE Peer Pairing through Kerrigan Sequence showing a developer acquiring a DevKit through a cloud control plane, starting a device forwarder through Kerrigan, exchanging ICE candidates through a signaling service, using either a direct UDP or TURN-relayed data path, and stopping the session with confirmed device cleanup. 01   AUTHORIZE + PREPARE — one developer, one allocated DevKit 02   NEGOTIATE + CONNECT — signaling is control plane; data stays peer to peer Acquire authorized DevKit devices.p2p.reserve reservation confirmed Create ICE session user ICE configuration devices.p2p.ice.start + device grant launch device forwarder WSS join with user-role credential WSS join with device-role credential relay ICE candidates only ALT [direct candidates work] direct UDP peer traffic in both directions [otherwise] TURN-relayed peer traffic in both directions 03   CLEAN UP — retain the allocation until the device confirms session removal devices.p2p.ice.stop stop + remove session closed Developer machine User-side forwarder Cloud control plane Authorization + allocation Signaling service Role-scoped WSS relay Kerrigan Lease + safety authority DevKit Device-side forwarder A successful stop acknowledgement permits Kerrigan to clear the peer state; allocation release then follows its normal durable lifecycle.

The signaling service exchanges ICE negotiation frames only. It never carries the peer data path. A direct candidate is preferred; TURN is the fallback when the peers cannot establish direct UDP connectivity.