# VibeLab Beam

> A private remote terminal to a Mac you own. End-to-end encrypted. Direct-first QUIC. No cloud account.

Beam lets a single technical user continue a PTY they started on their own Mac from an iPhone they own. STATUS: local engineering build only. Nothing is distributed. Apple signing and TestFlight are blocked pending authorization, and physical-device plus public-relay behaviour is unmeasured. Do not describe Beam as available, downloadable, or in beta.

## Canonical pages

- [Home](https://beam.tuanle.dev/): Product statement, primary flow, FAQ.
- [Features](https://beam.tuanle.dev/features): What Beam does and explicitly does not.
- [Security](https://beam.tuanle.dev/security): Actors, trust boundary, wire protocol, threat model.
- [Architecture](https://beam.tuanle.dev/architecture): Rust workspace, end-to-end flow.
- [Local status](https://beam.tuanle.dev/download): What local automation verifies, and the four external boundaries that remain open. No artifact is offered.
- [Docs](https://beam.tuanle.dev/docs): Quickstart, CLI reference, wire protocol summary, metrics.
- [Validation log](https://beam.tuanle.dev/changelog): Local evidence, and what nobody has measured yet. Not release notes; nothing has been released.
- [About](https://beam.tuanle.dev/about): Why Beam exists, VibeLab background.
- [Contact](https://beam.tuanle.dev/contact): Beta, support, security disclosure, press.

## Product statement

"Beam is a private remote terminal to a Mac you own." The target user is a single technical individual who administers their Mac and wants to keep working on a terminal task when they leave the desk.

## Value pillars

1. Install host and see the first prompt on iPhone in one short flow.
2. Pair by physical access at the Mac; no account, no cloud password.
3. Session lives at the host while the app is in background, as long as the daemon is alive.
4. Direct path first; one Singapore relay fallback that only forwards ciphertext.

## MVP boundaries (from PRODUCT.md and SRS)

In scope:
- Signed macOS 14+ Apple Silicon host installed via LaunchAgent.
- QR pairing with 120-second TTL; multiple Macs per iPhone and multiple iPhones per Mac.
- Direct-first for up to 3 seconds, then exactly one relay fallback; no live relay→direct upgrade.
- Machines list and Beam-created sessions list.
- Native SwiftUI terminal with ANSI/VT, accessory keys, multiline-paste preview.
- Local CLI: install, pair, devices, revoke, sessions, kill, audit, doctor, status, update.
- Privacy shield, Face ID / Touch ID, opt-in diagnostic export.
- English + Vietnamese, basic accessibility.

Explicitly not MVP:
- Android, iPad, Apple Vision, Windows, Linux, Intel Mac.
- Attaching Terminal.app, iTerm, tmux, or PTYs Beam did not create.
- SSH jump, SFTP, file transfer, port forwarding, SOCKS, remote desktop.
- Push notifications, recording, snippets, AI, microphone, voice command, orb/sphere.
- Accounts, cloud identity, team/RBAC, billing, pricing, commercial quota, public SLA.
- Cloud sync, automatic clipboard sync, persistent terminal output on iPhone.
- Sessions surviving `hostd` restart, logout, reboot, host update, power loss.
- Public App Store GA, public source release, external security review.

## Security model (high level)

- Trust root is the QR shown on the Mac screen; the host public key travels inside the QR.
- Handshake: Ed25519 long-term identity, X25519 / P-256 ephemeral, signed transcript.
- Transport: QUIC over UDP with TLS 1.3; relay forwards opaque datagrams.
- Replay buffer lives on the host in RAM; iPhone never persists terminal output.
- Privacy shield the moment the app is inactive; Face ID / Touch ID with 15-minute passcode fallback.

## Success metrics (MET-01 … MET-05)

- MET-01 Activation >= 80%
- MET-02 D7 return >= 40%
- MET-03 Activation time p80 < 3 minutes
- MET-04 Relay fallback reliability >= 95%
- MET-05 Direct success target >= 70%, floor >= 40% per network cell

## Optional

- [Atom changelog feed](https://beam.tuanle.dev/changelog.xml)
- [Sitemap](https://beam.tuanle.dev/sitemap.xml)
- [Robots](https://beam.tuanle.dev/robots.txt)