RobOS Private Networks & Zero-Trust App Mesh: Cross-Network mTLS 1.3 P2P Tunneling, Zero-Knowledge AES-256-GCM Rendezvous, Bidirectional Reverse-Mux, and 1080p/4K Movie Streaming Across Separate Networks

flowchart LR
  subgraph NetA["Network A — Box A (robos-workstation-alpha | 10.10.1.10)"]
direction TB
MPA["RobOS Movie Player (:19214)
& Local Stream Server (127.0.0.1:19215)"]
TUN["Local Bridge Tunnel (127.0.0.1:19225)
Mounts Box B :19215 [HTTP 206 Byte-Range]"]
GWA["App Mesh mTLS 1.3 Gateway (:19290)
ECDSA P-256 Pinning & Reverse-Mux Client"]
MPA --> TUN
TUN --> GWA
  end

  subgraph Fabric["Cross-Network Zero-Trust Fabric (NAT / CGNAT Traversal)"]
direction TB
RELAY["Self-Healing WAN Relay Ingress
wss://<relay-id>.lhr.life → HTTP 101 Upgrade
Forwards Raw Encrypted TLS 1.3 Bytes"]
RV["Zero-Knowledge Rendezvous Discovery
HMAC-SHA256 Opaque Topic + AES-256-GCM Beacon
+ 20s Active Relay Health Probe"]
MUX["Bidirectional Reverse-Mux Multiplexer
Multiplexes Inbound & Outbound Streams
Over Single Authenticated mTLS 1.3 Socket"]
  end

  subgraph NetB["Network B — Box B (robos-media-vault-beta | 10.20.2.20)"]
direction TB
UPG["HTTP 101 Upgrade Bridge +
App Mesh mTLS 1.3 Gateway (:19290)"]
MPB["RobOS Movie Player Stream Server (127.0.0.1:19215)
Cinema Catalog (/api/tv-library) + HTTP 206 Media"]
IPCB["95+ Shared RobOS App IPC & Service Ports
19100–19231, :3410 POS, :19210 Smart TV, :63343 IDE"]
UPG --> MPB
UPG --> IPCB
  end

  GWA <-->|End-to-End Mutual TLS 1.3| RELAY
  RELAY <-->|Raw TLS 1.3 Passthrough| UPG
  GWA <.->|Decrypts Rotated Relay URL| RV
  UPG <.->|Publishes AES-256-GCM Beacon| RV
  GWA <-->|Bidirectional Stream Framing| MUX
  MUX <-->|Reverse-Dial Across CGNAT| UPG
  

What We Built & Verified Across Two Separate Networks

• 1-Step Mutual Enrollment via robos-net:// (joinPrivateNetwork in packages/robos-lib/app-mesh-engine.js): Pairing two machines traditionally requires copying enrollment tokens in both directions and opening firewall ports. With RobOS Private Networks, Box B generates a single robos-net:// token containing its cryptographic random nodeId, X.509 SHA-256 certificate fingerprint, relay endpoint, and a secret enrollToken. When Box A runs node packages/private-networks/cli.js join "robos-net://...", Box A pins Box B's certificate and presents enrollProof = HMAC-SHA256(enrollToken, nodeIdA + ":" + fingerprintA) over TLS 1.3; Box B verifies the proof via crypto.timingSafeEqual and automatically pins Box A's client certificate in a single round-trip.
• End-to-End TLS 1.3 over HTTP 101 Upgrade + Self-Healing WAN Relay + Zero-Knowledge AES-256-GCM Rendezvous: To traverse NAT/CGNAT with zero accounts, ensureUpgradeBridgeServer() wraps the local TLS 1.3 gateway in an HTTP 101 WebSocket Upgrade bridge and tunnels it through an outbound SSH relay (wss://<relay-id>.lhr.life). The relay never terminates RobOS's Mutual TLS 1.3 session—it only forwards raw encrypted TLS 1.3 records. Because free SSH relays periodically rotate their subdomains (returning HTTP 502: no tunnel), we built a 20-second active HTTP health check (probeRelayHttpAlive) that automatically respawns dead tunnels and publishes an authenticated AES-256-GCM encrypted beacon (encryptRendezvousBeacon / decryptRendezvousBeacon, keyed by SHA-256(enrollToken + ":" + fingerprint) with nodeId as AAD) to an unguessable 128-bit topic (HMAC-SHA256(enrollToken, "robos-rv-topic:" + nodeId)). When Box A dials a rotated token, openPeerTlsSocket() transparently decrypts Box B's latest relay URL while leaking zero IPs, zero hostnames, and zero plaintext URLs to the internet.
• Bidirectional Reverse-Mux Stream Multiplexer (attachStreamMux): Because Box A may also sit behind strict NAT/CGNAT with no inbound ports, joinPrivateNetwork() immediately opens a persistent reverse-mux session over its outbound TLS 1.3 socket. Using a compact 9-byte binary frame header (OPEN, DATA, CLOSE, PING), Box B can dial Box A's local ports (such as Box A's :19215 Movie Player stream server or 19100–19231 App IPC ports) back across Box A's outbound socket.
• Cross-Network 1080p/4K Movie Streaming in RobOS Movie Player (packages/movie-player/lib/library-folders.js): Both cli.js host and cli.js join start the local RobOS Movie Player HTTP 206 stream server on 127.0.0.1:19215, mount the remote peer's stream server onto 127.0.0.1:19225, and write ~/.config/robos/movie-player/active-peer-bridge.json. Opening RobOS Movie Player (or clicking + P2P Peer in the Library Folders sidebar) automatically syncs the remote peer's movie catalog (/api/tv-library?all=1), rewrites stream URLs to the local mTLS bridge (http://127.0.0.1:19225/media/...), and streams .mp4, .mkv, and .webm films with instant HTTP 206 Partial Content byte-range scrubbing.

# 1. Run the 10-test App Mesh, Cross-Network Reverse-Mux & Movie Player P2P Folder suite
node --test packages/robos-lib/app-mesh-engine.test.cjs packages/movie-player/lib/library-folders.test.js

# 2. On Box B (Network B): Start the Zero-Trust mTLS 1.3 Host & Self-Healing WAN Relay
node packages/private-networks/cli.js host

# 3. On Box A (Network A): Join Box B's Private Network and mount Box B's video catalog on 127.0.0.1:19225
node packages/private-networks/cli.js join "robos-net://<INVITE_TOKEN>"

# 4. Query Box B's cinema catalog and verify HTTP 206 Partial Content byte-range video streaming
curl -s "http://127.0.0.1:19225/api/tv-library?all=1" | jq '{nodeName, totalCount, titles: [.items[].title]}'
curl -I -s -H "Range: bytes=0-65535" "http://127.0.0.1:19225/media/f_1_stream.webm"

RobOS P2P & Zero-Trust App Mesh Guide → RobOS Private Networks Docs → RobOS App Mesh Docs → Commit 5a47ff9a (RobOS Private Networks & Movie Player P2P) → Commit 57f6582d (Host stream server & bridge port isolation) → Commit 921eb6c3 (Self-healing WAN relay & rendezvous discovery) →