oficina / meet Public

Call and MediaEngine are main-actor owned. The Go listener dispatches in arrival order onto that actor. Each peer serializes asynchronous SDP operations; late callbacks check the peer's closed flag, and the Go sender checks generation before accepting a signal. Candidate queues are bounded and drained only after a remote description. A call epoch discards callbacks from an earlier room.

@preconcurrency import CallsBridge describes an Objective-C boundary whose thread safety is supplied by the Go mutexes and tested with the race detector. It is not an assertion that WebRTC objects can be used from arbitrary threads.

Native sign-in opens the default system browser. The shared Go client creates a random verifier, sends its SHA-256 challenge to /native/request, and polls /native/exchange with the verifier. /native/start keeps a short-lived pending cookie while the existing sign-in and invitation continuation run. The browser then shows the signed-in account, a code matching the app, and an explicit same-origin protected approval form. JavaScript is unnecessary.

The server retains bounded requests in memory for five minutes. Exchange is single-use and revalidates the approving browser session and current identity before minting a separate normal framework session. Home subject, method and authentication time are preserved. A browser URL contains neither the verifier nor a session token. Request/exchange honor no ambient cookie, forbid redirects in the client and expose no CORS access. Cancellation stops the app's polling; the unconsumed server request expires. This is a Calls session handoff, not an OAuth authorization server or a replacement for Home assertion verification.

The web's Join in the app starts the same handoff from the other end (2026-10-02). GET /m/{sqid}/app, with the browser's session and standing, makes an offer: random, five minutes, one per browser session, bound to that session's cookie hash and the meeting. The app link carries it. The app's /native/request names it (BeginOfferAuthentication), which binds that one request to it — a second claim is 410 — and the waiting page in the browser that made the offer (/native/offer?o=…, readable only by that session) turns into /native/authorize for the request. Approval and exchange are unchanged. The offer is not a credential: a claim yields only a request id, and only the offering browser can see which request claimed it or approve it.