Linux Agent connections over pinned WSS, explicit Edge relay, and automatic direct-to-Edge fallback.
Windows Agent TOTP and bounded SDP/ICE signaling on TCP 39501, with H.264 video and input carried by WebRTC and automatic BGRA+zlib/TCP fallback when WebRTC is unavailable.

Windows connections intentionally do not require TLS or a certificate fingerprint. TOTP is still mandatory, but it does not encrypt the connection. Expose the Windows Agent only on a trusted LAN or through a private VPN/AnyTLS tunnel.

On Android, flutter_webrtc keeps RTP, jitter handling, H.264 decode, and Texture rendering in the native WebRTC stack. Dart only exchanges bounded SDP/ICE and small DataChannel input messages. The BGRA fallback is bounded but slower because it inflates full frames in Dart.

Local verification

flutter pub get --enforce-lockfile
dart format --output=none --set-exit-if-changed lib test
flutter analyze
flutter test
flutter build apk --release

Without release-signing environment variables, Gradle uses the Android debug certificate so local release-mode builds remain installable for testing. Production tag builds must run through the Drone signing flow documented in docs/ci-drone.md.