I1 Remote access for the household

Requirements

1. I1-R1acceptedMUST

   Remote access MUST NOT depend on a proprietary or closed coordination plane, and MUST NOT configure a path whose terms of service forbid media streaming.

   locked by

   0.22.0 ○ open

2. I1-R2acceptedMUST

   The tool MUST detect whether the line has a publicly reachable address or is behind CGNAT, and MUST NOT offer a path that cannot work on the detected condition.

   locked by

   0.22.0 ○ open

3. I1-R3acceptedMUST

   A self-hosted overlay network MUST be the default archetype, using a self-hosted control plane and a self-hostable relay so no third party coordinates or carries traffic.

   locked by

   0.22.0 ○ open

4. I1-R4acceptedMUST

   The public-ingress archetype MUST be offered only when a publicly reachable address exists, and MUST be refused unless authentication is configured.

   locked by

   0.22.0 ○ open

5. I1-R5acceptedMUST

   The tool MUST NOT enable UPnP or otherwise weaken the router to obtain an inbound port; where a port is required it MUST emit the exact rule and verify externally whether it took.

   locked by

   0.22.0 ○ open

6. I1-R6acceptedMUST

   Reachability MUST be proven from an off-network vantage by fetching a known service endpoint and asserting success and expected identity — a local "connected" state MUST NOT be reported as reachable.

   locked by

   0.22.0 ○ open

7. I1-R7acceptedMUST

   On a TLS ingress path, the tool MUST verify the certificate chains to a public root, matches the hostname, and is not near expiry.

   locked by

   0.22.0 ○ open

8. I1-R8acceptedMUST

   On a tunnel path, the tool MUST verify a recent handshake and advancing traffic counters.

   locked by

   0.22.0 ○ open

9. I1-R9acceptedMUST

   The tool MUST report whether an overlay connection is direct or relayed, and MUST NOT present a relayed path as equivalent to a direct one.

   locked by

   0.22.0 ○ open

10. I1-R10acceptedMUST

    The tool MUST verify that the access hostname resolves to the current address and MUST report a stale dynamic-DNS record with the observed and expected values.

    locked by

    0.22.0 ○ open

11. I1-R11acceptedMUST

    The tool MUST verify that a service intended to be tunnel-only is not also directly reachable on the WAN.

    locked by

    0.22.0 ○ open

12. I1-R12acceptedMUST

    A failed or inconclusive external proof MUST be distinguished from each other and from success, and each failure MUST carry a remedy (G4).

    locked by

    0.22.0 ○ open

13. I1-R13acceptedMUST

    Device enrolment, key issue, key rotation, and the reachability proof MUST each be reachable non-interactively.

    locked by

    0.22.0 ○ open

14. I1-R14acceptedMUST

    Configuring remote access MUST NOT expose any administrative surface beyond its existing binding policy (C6).

    locked by

    0.22.0 ○ open

15. I1-R15acceptedMUST

    Credentials and keys created for remote access MUST be managed and rotatable through the same path as other secrets (A7).

    locked by

    0.22.0 ○ open