KRDP — Koder Remote Access Protocol + the remote-access product module (RustDesk/AnyDesk/TeamViewer/RDP-class, native & fast, ID-brokered)

Status

Ratified 2026-06-10 (owner ratified the module name Koder Pilot via /k-go). Ratifies the owner braindump (WhatsApp "Mensagens para mim", 2026-06-07/08, print "Criar especificação de protocolo que contemple o RDP e o RustDesk"). Specifies the protocol and decides the module name + shape; the canonical module name is proposed here, pending owner ratification (§7).

Problem

The owner wants a native, fast remote-access stack for Kodix (and every Koder surface), competitive with Windows RDP on latency — because the prevailing Linux remote-access solutions are VNC-based and markedly slower than RDP — and carrying the RustDeskAnyDeskTeamViewer ergonomics: a connection ID anyone can read out, a permission/consent model, unattended access, file transfer, clipboard copy/paste, and device forwarding (USB, audio, camera, and — where the OS allows — HDMI capture, Bluetooth, Wi-Fi/wired network). It must run as a service/daemon AND through a Desktop module for ordinary users, with components for service + desktop + web + mobile.

Today the Stack has scaffolding but no cohesive protocol:

• infra/net/remote (component, 8 pending tickets): #001 agent-daemon,

  #002 NAT-traversal relay, #003 remote-desktop view/control, #004 file-transfer, #005 device-inventory, #006 unattended-access, #007 v4l2 camera, #008 screen-capture X11+Wayland. This is the host/agent backend, RustDesk-server-shaped — but the tickets are loose features with no wire contract binding them.

• products/dev/grid (Koder Grid): a multi-protocol tiling viewer for

  SSHRDPVNC, with a vendored IronRDP (Rust RDP) web bridge. It is a power-user client, not the protocol or the consumer product.

• Koder Beam (products/horizontal/beam, stack-RFC-010): GPU/game streaming

  (Parsec-class). Adjacent but distinct — Beam optimizes a GPU framebuffer for gaming; KRDP optimizes interactive desktop/device control at low input-RTT.

There is no protocol spec, no module name, and no product shape decision. That is this RFC.

Decision

Adopt two artifacts with a clean boundary:

Analogy: Microsoft Remote Desktop (the app) speaks RDP (the protocol). Here the Koder Pilot app/service speaks KRDP. The protocol name (KRDP) the owner coined stays; the module gets its own brand (§7).

Why a new native protocol (vs. adopting RDPVNCRustDesk wholesale)

Per self-hosted-first.kmd (build-vs-adopt) + architecture-quality D12 (root-cause): VNC's slowness is structural (full-framebuffer, no real input prediction); RDP is fast but proprietary/Windows-centric and awkward to extend with ID-brokering; RustDesk is GPL and its protocol isn't a contract we own. A Koder-owned protocol lets us (a) reuse engines/kodec (the same NVENC/SW encoder Beam de-risked — BEAM-001) for the video leg, (b) reuse Koder ID for identity + Koder DNS/relay (infra-RFC-007) for ID-brokering/NAT traversal, and (c) own the device-forwarding channels. Interim (shadow-active): the existing IronRDP path in Grid + an RDP/VNC bridge stay usable so we ship value before KRDP parity — same shadow-active discipline as kodec and Beam.

KRDP protocol — specification (normative outline)

P1. Transport

• Primary: QUIC (UDP, multiplexed streams, 0-RTT resume, congestion control,

  mandatory TLS 1.3) — the low-RTT path for native service↔client.

• Web: WebRTC DataChannel + WebTransport fallback so the web client runs in

  any browser without a plugin (the consumer`k-web-app` install path).

• Relay fallback: TURN-like via Koder relay (infra/net/remote#002) when both

  peers are behind symmetric NAT — the RustDesk "relay server" role, hosted on Koder infra (self-hosted-first), brokered by ID (§P5).

• Always-on (always-on.kmd): the wire format is versioned (krdp/1) with a

  capability-negotiation handshake so old clients keep working across upgrades.

P2. Session & channels (multiplexed over the transport)

A KRDP session is a set of typed channels; absent a channel = capability not granted (§P6):

P3. Codec & rendering

• Reuse engines/kodec (NVENC hardware on capable hosts; SW fallback) — the

  encode leg Beam already de-risked (BEAM-001: NVENC 1080p60 viable in-LXC). KRDP tunes for interactivity (low latency, damage tiles, adaptive bitrate on input bursts) rather than Beam's sustained game-framebuffer profile.

P4. Identity & ID-brokering (the RustDesk/AnyDesk ergonomics)

• Every host registers with the Koder relay/registry and is addressable by a

  human-readable connection ID (RustDesk-style numeric/word ID) and by its Koder ID (for managedunattended fleet devices, `#005#006`).

• ID-brokering reuses infra-RFC-007 (service discovery/relay) + Koder ID

  (auth) + Koder DNS — no new identity plane. A one-time session password or Koder ID grant authorizes a connect (RustDesk "permanent password" vs "one-time" — both modes).

P5. Permissions & consent

• Attended (consumer): the host shows a consent prompt ("X quer controlar

  sua tela — Aceitar/Recusar") with per-capability toggles (view-only / control / clipboard / file / audio / device). Default-deny; least privilege.

• Unattended (managed, #006): persistent agent + pre-granted policy, fenced by

  Koder ID + per-device grant; full audit trail (observability-first.kmd).

• Multi-tenant by default (multi-tenancy/contract.kmd): a host belongs to a

  tenant; cross-tenant connect needs an explicit grant (mirrors Tribus' carve-out).

P6. Security (security.kmd + RFC-009 mTLS PKI)

• TLS 1.3 / QUIC mandatory; per-session keys; optional E2E (relay can be

  zero-knowledge). Per-service identity via the mTLS PKI (RFC-009). Every connect + capability grant is audited. No HTTP/plaintext leg, ever.

Module shape (RFC-003/006)

The owner wants service + desktop + web + mobile. That is a product Sector (direct human interaction) with an infra-operated backend:

products/horizontal/pilot/
├── backend/         ← host daemon (the "service"): runs headless, registers ID,
│                       serves KRDP; absorbs infra/net/remote agent (#001) + relay (#002)
├── app/
│   ├── desktop/     ← Flutter desktop client (ordinary users) — connect by ID, share screen
│   ├── web/         ← Flutter Web / WebTransport client (the koder_web_kit#038 PWA-install path)
│   └── mobile/      ← Flutter mobile (control-from-phone + share-phone-screen)
└── landing/

• infra/net/remote is re-homed/absorbed as this module's backend (its 8

  tickets become the backend's feature backlog), so we don't run two remote stacks.

• Koder Grid stays the power-user multi-session viewer and gains KRDP as

  a first-class protocol alongside SSHRDPVNC — Grid is a consumer of KRDP, not a replacement for the new consumer product.

• Area: products/horizontal/ (general-purpose, cross-vertical) is the natural

  home (like Beam). Path ratified: products/horizontal/pilot/.

Self-hosted-first pair

Register a new flipping-point pair (registries/self-hosted-pairs.md): Koder Name / KRDP replaces rustdesk, anydesk, teamviewer, microsoft-rdp, tigervnc/realvnc, nomachine — status planning, gated on protocol parity + lower input-RTT than VNC (the headline gate) + production-proven. Shadow-active interim = Grid's IronRDP + RDP/VNC bridge.

Naming (RATIFIED — §7)

Owner-ratified 2026-06-10: the module is Koder Pilot (products/horizontal/pilot, CLI kpilot, slug koder-pilot). Registered in component-names.md. The table below is the original proposal kept for the record.

The protocol is KRDP (Koder Remote Desktop Protocol — owner-coined; keep). The module/product name candidates (brand-score: short, evocative of *remote control, no collision, clean `k` CLI binary):

Avoided: Helm (collides with Kubernetes Helm), Beam (taken — GPU streaming), Relay/Remote (taken/generic), Link (collision-prone). The chosen name lands in component-names.md + the koder.toml name in the same commit (audit cross-check, naming-aliases.kmd).

Slice plan (incremental, each shippable)

1. Spec slice — normative specs/remote/krdp/protocol.kmd (P1–P6 as testable

   Rn/Tn). + name ratification + registry rows.

2. Backend MVP — host daemon registers ID via relay; video+input+control

   over QUIC; kodec encode; attended consent. Absorb remote#001/#002/#003.

3. Desktop client — Flutter desktop: connect-by-ID, view+control, clipboard.
4. Web client — WebTransport/WebRTC; PWA-installable (koder_web_kit#038).
5. Mobile client + file/device channels (#004/#007) + unattended

   (#006).

6. Grid integration — KRDP as a Grid protocol. Flip gate: input-RTT < VNC,

   feature+regression parity, prod-proven → self-hosted-pair flips.

Non-goals

• GPU/game streaming (that is Koder Beam, stack-RFC-010).
• Replacing SSH (Grid keeps SSH; KRDP is desktop/device, not a shell).
• Raw USBPCIe tunneling where the OSsecurity model forbids it — device channel is

  scoped per-platform honestly (capture/inventory vs. true forwarding).

Consequences

• Positive: one owned, fast, ID-brokered remote-access protocol + a

  consumer-grade product (service+desktop+web+mobile), reusing kodec + Koder ID + relaydiscovery — no new identityedge planes. Kodix gets a first-party remote-access story superior to VNC.

• Cost: a real protocol + four client surfaces; de-risked by reusing kodec

  (Beam) + IronRDP/RDP-VNC bridge as shadow-active interim.