carlos / platform Public

Stage 4a: platform STUN and TURN relay (implementation)

Implements docs/superpowers/specs/2026-09-07-relay-stun-turn-design.md (revision 6, codex accept, Paul's six rulings) through the plan at docs/superpowers/plans/2026-09-07-relay-stun-turn.md. 26 commits, 54 files.

What lands:

• internal/relay: the credential contract (spec §2, test vector pinned), masters file with hot reload and retire_at, authority record and serving lease, admission limits and token buckets, wrapped relay sockets (termination, metering, EIP port gate), the pion/turn v4.1.4 server with owner binding on the typed source and every termination deadline, the per-app meter with its own hourly objects, and Serve with the sixty-second authority read, heartbeat, PSI shedding and store-open retry.
• carlos-relay.service, armed fleet-wide behind ConditionPathExists=/etc/carlos/relay-masters, started by bootstrap, restarted on platform update.
• Console: relay operations under a writer lease, etag-first aggregate publish, a converging five-minute reconcile, enable/disable/adopted/rotate with the spec's state transitions, purge republishing the aggregate; five CLI doors; carlos relay enable|status|disable|adopted|rotate|keygen|serve.
• Per-route config acknowledgement written by the config sync, naming the rendered relay identities, read by carlos relay status.
• infra/modules/region-host: relay variable opening udp+tcp 3478 and udp 49152-65535 inline, vpc_cidr output.
• docs/site/cli.md ### carlos relay, copy-reviewed.

New dependency: github.com/pion/turn/v4 v4.1.4 and its pion family, pure Go, cross-compiles clean for all five CI targets.

Reviewed task by task (Opus on the security-bearing tasks) and as a whole branch; every finding fixed or ledgered with a ruling. Two spec deviations, both recorded for amendment: the record carries issued_digest (sha256 of the sealed envelope) rather than config_generation; status does not yet print the retirement time because no rotation time is persisted.

Not in this branch: the pinfra half (flagship relay = true, the relay.<region> A record, staging /etc/carlos/relay-masters and CARLOS_RELAY_DENY_CIDRS, the console's CARLOS_RELAY_REGIONS and CARLOS_RELAY_MASTERS_<REGION>). Arm platform boxes only; never a fleet box (its store door refuses the relay's writes). Verify the relay hostname against flagship's domain or set CARLOS_PLATFORM_DOMAIN before enabling an app.