Architecture · Kandev · doc-wide · balanced

How a phone reaches Kandev

Private network paths protect one Kandev origin, which routes the task session to the selected executor and repository.

How a phone reaches Kandev A phone reaches one Kandev origin through Tailscale Serve, Cloudflare Access with cloudflared, or a private VPN. Kandev then routes the task session to the selected executor and repository. PROTECTED ACCESS KANDEV ORIGIN TASK EXECUTION Phone browser Tailscale Serve private HTTPS Cloudflare Access identity policy cloudflared outbound connector Private VPN encrypted network Kandev origin HTTP + WebSocket Task session workspace-scoped Executor selected runtime Repository task worktree PROTECTED ACCESS PATH TASK ROUTE SINGLE KANDEV ORIGIN