feat: integrate E2EE remote-control foundation

[Lokesh7025]

Purpose

Create the shared E2EE integration branch for reviewed Person 2 transport, daemon-authorization, and SDK-delivery work. This PR supersedes #392 and will remain the integration PR while Person 1 develops the reviewed cryptographic implementation from origin/RC.

Fixes

N/A

Approach

RC currently contains:

• the TypeScript control-plane ticket and authenticated internal-service boundary
• the Elixir/OTP bounded opaque WebSocket relay
• role-filtered route discovery and strict device <-> daemon topology
• explicit heartbeat, half-open, slow-consumer, lease, draining, and revocation behavior
• generation-bound tickets and stale-ticket rejection
• cross-language framing and internal-contract fixtures
• durable daemon device grants, hosted/local scope intersection, terminal revocation, explicit RPC-to-scope mapping, and internal dispatcher integration behind fake E2EE
• SDK opaque durable-outbox interfaces and exact ciphertext-byte retry behavior
• the reviewed remote permission-authorization draft, without enabling remote approval

This PR does not implement or enable real PQXDH, Triple Ratchet, pairing cryptography, cryptographic replay handling, secure ratchet persistence, prekey lifecycle, attachment cryptography, S3 integration, or ordinary-session remote access.

Person 1 should branch from origin/RC, implement cryptography independently of the relay, and merge reviewed integration commits back into RC. RC will merge to main only after the staged security and integration gates pass.

How was this tested?

Passed on the integrated RC branch:

• pnpm check
  • 909 tests
  • 904 passed
  • 5 platform skips
  • 0 failures
• pnpm relay:check
  • 16 relay tests passed
  • Mix formatting and warnings-as-errors compilation passed
  • Credo passed
  • Dialyzer passed
  • dependency audit passed
• pnpm audit --audit-level high
• reuse lint
• node scripts/check-dco.ts origin/main HEAD

PR #392 also passed TypeScript build/test, relay build/test, workflow lint, CodeQL, REUSE, DCO, dependency review, lockfile audit, and Gitleaks before being integrated into RC.

Learning

The relay remains independent of cryptographic message formats. Person 1 can develop and test the endpoint cryptography against an in-memory mailbox, while RC retains opaque-byte transport, authorization, delivery, and failure semantics.

Checklist

• I reviewed the complete diff.
• I added or updated the smallest relevant test for behavior changes.
• I ran the relevant formatting, lint, type-check, test, boundary, and license checks.
• Every new file has SPDX metadata, directly or through REUSE.toml.
• Every commit has a matching DCO Signed-off-by trailer.
• UI changes include screenshots attached to the pull request, not committed to the repository. (N/A: no UI changes.)

Licenses

Resource	Source and version	License	Use
Bandit	Hex 1.12.5	MIT	Relay HTTP/WebSocket server
Plug	Hex 1.20.3	Apache-2.0	Relay HTTP boundary
WebSock Adapter	Hex 0.6.0	MIT	WebSocket upgrade adapter
Credo	Hex 1.7.12	MIT	Development-only static analysis
Dialyxir	Hex 1.4.6	Apache-2.0	Development-only type analysis
mix_audit	Hex 2.1.5	BSD-3-Clause	Development-only dependency audit

AI assistance

• Generative AI materially assisted this change. Tool and model/version: pi coding agent with Azure OpenAI gpt-5.6-sol.
• I manually reviewed, understood, and tested the generated work.

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

services/control-plane/package.json

Package	Version	License	Issue Type
@axl/protocol	workspace:*	Null	Unknown License

Denied Licenses:

SSPL-1.0, BUSL-1.1, Elastic-2.0

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/cache	0057852bfaa89a56745cba8c7296529d2fc39830	🟢 6.2	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 8 10 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 8 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection ⚠️ 1 branch protection is not maximal on development and all release branches
actions/erlef/setup-beam	54075bcc5e249e4758d363f27d099f55d843f124	🟢 6	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 Code-Review ⚠️ 1 Found 3/16 approved changesets -- score normalized to 1 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Security-Policy 🟢 10 security policy file detected SAST 🟢 8 SAST tool is not run on all commits -- score normalized to 8
npm/@axl/protocol	workspace:*	Unknown	Unknown

Scanned Files

• .github/workflows/ci.yml
• services/control-plane/package.json