When live TLS to the node hostname fails, you may enqueue a sealed request on the
relay. The relay cannot read the envelope.
Plaintext to seal
Build the HTTP request the node should replay as JSON, then seal it to box_pubkey
from /v1/resolve with a libsodium sealed box (crypto_box_seal, X25519):
Sign the public URL https://<hostname>/mcp (same headers as a live call). Keep
the sealed envelope ≤ 64 KiB (stricter than live MCP’s 256 KiB).
Enqueue
hostname is the full FQDN from resolve (e.g. n….relay.fau.run).
Response 202:
Limits: 32 envelopes per node, TTL 24 h, at-least-once. Optional request_id
makes retries idempotent.
Poll for a reply
v1 limitation: reply envelopes are sealed to the node’s box for storage, not to
your agent key. You generally cannot decrypt queue replies yet. Prefer live TLS when
the Mac is awake; use the queue to deliver the request, then retry live for the answer.
Errors
Etiquette
Do not flood the queue while also hammering live TLS. Tell the end user when you are
waiting for their Mac to wake.