Pairing

Identity

Every device generates an identity locally on first launch. The private key is sealed on the device. Only the registry record is published to the Coordinator so other paired devices can discover it.

First-device pairing

On the first device, MeshStack creates the mesh and stores the local identity. The Coordinator is contacted for registry only. No prompts, models, or files are uploaded.

Adding a trusted device

On an already-paired device, generate a short-lived pairing payload. On the new device, approve the mutual fingerprint. Both ends verify the fingerprint match before the new device is added to the mesh.

After approval, the two devices establish a private channel using the WireGuard protocol. Subsequent traffic on the same LAN flows directly between devices.

Recovery

Lost a device? Pair a replacement from another already-paired device. There is no cloud key custody, no cloud backup, and no THOX-mediated recovery. Keep at least one Anchor or Lead Device available so the mesh can re-admit a replacement.