vpn service sync

docs/BUILD_DEPLOY.md

@@ -55,6 +55,17 @@ cd orchestration
 
 Direct debug ports: crashes `:8082`, builder `:8083`.
 
+## Local developer rebuild
+
+`./rebuild.sh` (repo root):
+
+1. `scripts/init-third-party-submodules.sh` — libvpx, opus, speex, **wireguard-android** (+ nested wireguard-tools / elf-cleaner)
+2. `scripts/build-native-codecs.sh` per ABI
+3. `./gradlew :tunnel:assembleDebug :app:assembleDebug` — WireGuard userspace (`libwg-go.so`) from `third-party/wireguard-android`
+4. Unit tests, adb install (when devices configured)
+
+No runtime fetch from zx2c4/GitHub during Gradle: sources come from checked-out `third-party/` submodules only.
+
 ## Trigger a build
 
 1. Open Builder → sign in (default dev user from crash schema seed).

docs/REMOTE_ACCESS_IMPL.md

@@ -25,7 +25,7 @@ See the full proposal: [20260602_REVERSE_SSH_proposals_summary.md](20260602_REVE
 - **WireGuard:** foreground service; jittered poll **1–7 min** → `heartbeat.php` with `type: ra`
 - Heartbeat URL derived from crash upload URL (`…/api/heartbeat.php`)
 - Session credentials persisted until `expires_at`; expiry tears down tunnel locally
-- Optional full userspace WG via `third-party/wireguard-android` (`:tunnel`); otherwise `RemoteAccessVpnService` TUN fallback
+- Userspace WG via `third-party/wireguard-android` (`:tunnel` / `GoBackend`) in isolated process **`com.foxx.androidcast:vpn`**; main app controls via AIDL (`IVpnService` / `VpnServiceClient`); TUN fallback only if GoBackend fails
 
 ### Android VPN consent (WireGuard)
 
@@ -148,14 +148,28 @@ Internet UDP :51820 → FE DNAT → BE wg0 :51820
 
 Hostname `ra.apps.f0xx.org` (or similar) should resolve to the FE public IP. Devices use `wg_endpoint` from config/connect payload.
 
+## VPN process (AIDL)
+
+| Component | Process | Role |
+|-----------|---------|------|
+| `VpnServiceClient` | main (`com.foxx.androidcast`) | Binds to `IVpnService`; async apply/tearDown + state callbacks |
+| `AndroidCastVpnService` | `:vpn` | AIDL stub; worker thread for tunnel ops |
+| `WireGuardVpnEngine` | `:vpn` | `GoBackend` + TUN fallback |
+| `RemoteAccessVpnService` | `:vpn` | `VpnService` TUN when GoBackend fails |
+| `GoBackend$VpnService` | `:vpn` | WireGuard tunnel library VPN entry (manifest merge) |
+
+Developer settings still uses `VpnService.prepare(Activity)` for the one-time consent dialog (same app UID).
+
+**Crash capture:** `CrashReporter.install()` registers uncaught handlers in `:vpn` (scenario `vpn_service`, process `com.foxx.androidcast:vpn`). Reports persist to shared app storage and upload via `:crashwatcher`. Lab: `scripts/simulate-vpn-crashes.sh` (debug APK + `MODE=device`, or `MODE=upload` for BE ingest validation).
+
 ## WireGuard third-party (Android)
 
 ```bash
-bash scripts/init-wireguard-submodule.sh
-./gradlew :app:assembleDebug   # includes :tunnel when submodule present
+bash scripts/init-third-party-submodules.sh   # or ./rebuild.sh (includes init + :tunnel build)
+./gradlew :tunnel:assembleDebug :app:assembleDebug
 ```
 
-Without the submodule, `WireGuardTunnelBridge` uses `RemoteAccessVpnService` (TUN only — sufficient for lab; prefer `:tunnel` for production tunnels).
+Gradle fails fast if the submodule is missing. VPN runs in `:vpn` (`AndroidCastVpnService` + AIDL); `WireGuardVpnEngine` uses `GoBackend` with TUN fallback in the same process.
 
 ## Tests
 

docs/drafts/20100611_1_net_obfuscation.txt

@@ -0,0 +1,6 @@
+Network traffic obfuscation
+
+Definitions:
+- E2E - E2E encryption
+- P2P - P2P encryption
+- POLY - Polymorphic ciphers, persistent and temporary keys

docs/drafts/20100611_1_net_topology_glossary.txt

@@ -0,0 +1,12 @@
+network topology glossary (to be used as a code names within the product):
+
+1. SIRENE - P2P-alike topology
+2. SPIDER - MCU-alike topology
+3. SPIDERWEB - SFU-alike topology
+4. MINE - mesh-alike topology
+
+5. SLY - E2E/VPN/hidden/any
+6. BLUEMOON - Bluetooth-transported any available (mesh, P2P)
+7. SLOTH - passive
+
+and the combinations of them: SIRENE SLOTH - slow-to-respond passive P2P networking; SPIDER SLY - hidden non-transparent network activity using MCU-alike topology; MINE BLUEMOON, etc.

docs/drafts/20100611_2_av_conversion_and_non_rt.txt

@@ -0,0 +1,17 @@
+Audio/Video RT and non-RT
+linked drafts:
+ - Network obfuscation
+ - Transport layers
+ - Network topology
+ - Paid services
+ - End-user services
+
+The service (standalone or the current one, depends on max. capacity, bandwidth, storage trade-offs, CPU load) should provide:
+
+1. RT AV
+- RT streaming and casting using well-known codecs and transports, including store recordings services for offline / non-RT usage
+
+2. non-RT AV
+- non-RT on-demand conversion routines with additional services, like:
+** reproducible (playable) streams
+** ability to download/delete streams