Carrier
Quinn 0.11 over UDP.
Implementation reference
This page describes the code on the Arcen main branch at source revision eac2494, dated 13 August 2026. It separates implemented code, physical test evidence, release gates and roadmap work.
Application stack
| Component | Implementation | Platform boundary |
|---|---|---|
| Arcen Deck | Rust, egui 0.35, eframe 0.35, wgpu |
AppKit input and window integration, VideoToolbox decode, Core Graphics display identity, Core Audio playback |
| Linux Pier | Rust service plus embedded arcen-capenc |
PAM authentication, dedicated Xorg sessions, NvFBC/CUDA/NVENC or X11/OpenH264, uinput |
| Windows Pier | Rust LocalSystem service, user-session agent and Credential Provider | WTS/LogonUser, DXGI/WGC capture, NVENC or Media Foundation, WASAPI, Win32 input |
Transport and wire
Quinn 0.11 over UDP.
rustls 0.23, TLS 1.3, ALPN arcen-quic-v1.
Tungstenite message framing runs over the QUIC byte stream. JSON control and binary media share the authenticated session.
No TCP or WSS fallback is enabled in product builds. A failed QUIC connection fails closed.
3.type discriminator.The shared transport crate contains reviewed stream/datagram primitives for later carrier work. Current Direct products do not send video as QUIC datagrams.
Trust and authentication
| Layer | Linux Pier | Windows Pier | Failure behavior |
|---|---|---|---|
| Pier identity | Operator PKI certificate chain, or Pier-generated self-signed certificate pinned by SHA-256 fingerprint. | Expired, untrusted or changed identity fails before workstation authentication. There is no silent downgrade. | |
| User authentication | PAM inside the dedicated session path. | LogonUserW, WTS session attachment and Credential Provider for cold first login/unlock. |
Arcen does not issue user accounts. The target operating system remains authoritative. |
| Credentials | Submitted only after QUIC/TLS and Pier trust succeed. Password material is zeroized and is not serialized into saved connections. | Resume is credential-free and memory-only; TLS identity, endpoint or topology changes invalidate it. | |
| Licensing | First-party signed offline Trial/Node-Locked licence bound to Pier HostID. | No online licence service is required. The current production key ring is still empty, so release startup remains fail-closed until the signing ceremony and target validation. | |
Arcen does not operate an identity provider, certificate authority, session broker or online licence service for the Direct path.
Video pipeline
| Deck mode | Requested codec | Chroma | Bit depth | Frame-rate ceiling |
|---|---|---|---|---|
| High | H.265 / HEVC | YUV 4:4:4 | 8-bit | 60 fps |
| Standard | H.264 / AVC | YUV 4:2:0 | 8-bit | 30 fps |
| High Legacy | H.264 / AVC | YUV 4:2:0 | 8-bit | 60 fps |
| Host path | Capture | Encoder | Contract ceiling | Notes |
|---|---|---|---|---|
| Linux NVIDIA | NvFBC to CUDA | NVENC H.264/H.265, 4:2:0/4:4:4 | 8192 x 8192, 240 fps before runtime GPU narrowing | Zero host-copy hardware path; production sessions are capped by Deck policy and measured admission. |
| Windows NVIDIA | DXGI Desktop Duplication or WGC to D3D11 | NVENC H.264/H.265, 4:2:0/4:4:4 | 8192 x 8192, 240 fps before runtime GPU narrowing | WGC is used when DXGI produces no frames, including some headless or virtualized cases. |
| Windows software | WGC, D3D11 staging readback | Inbox Media Foundation H.264 | 4096 x 4096 at 60 fps | BGRA is converted to NV12 in Rust. Actual supported modes are driver- and MFT-dependent. |
| Linux software | Authenticated dedicated-Xorg X11 capture | Source-built OpenH264 Baseline | 1920 x 1200 at 30 fps | H.264, YUV 4:2:0, local cursor only. Physical performance and external distribution remain release gates. |
Resolution and multi-monitor
Multi-monitor is not one stitched video canvas. Deck sends the local display topology. Pier applies a host topology, assigns each monitor a nonzero session monitor ID and stream epoch, and runs independent capture, encode, queue, decode and presentation state per monitor.
| Limit | Current value | Meaning |
|---|---|---|
| Monitor count | 1-4 | Match My Layout uses every active Deck display up to four; admission is all-or-nothing. |
| Protocol geometry | 320 x 240 to 16384 x 8640 | Wire validation bound, not a performance or backend support claim. |
| Deck refresh request | Maximum 60 Hz | All current performance modes cap the stream at 60 fps. |
| Linux virtual framebuffer | 8192 px per dimension | Aggregate dedicated-Xorg topology bound. |
| Release hardware targets | 4 x 1080p60 or 2 x 4K60 | Targets for measured admission; not a guarantee for every host. |
| 4 x 4K | No blanket claim | Allowed only if the exact host proves the complete encoder set during admission. |
arcen-keel divides each region into a 16 x 16 activity
grid. The grid identifies changed content; it does not divide the
display into separate network resolutions. Static regions may skip
conversion, encode and emission between bounded refresh deadlines.
Startup frames, requested IDRs, recovery, keyframe deadlines and
input/focus wake events always force service.
Keyboard, pointer and Wacom
| Input path | macOS Deck | Linux Pier | Windows Pier | Status |
|---|---|---|---|---|
| Keyboard and mouse | AppKit/egui event capture; absolute and relative pointer modes | uinput keyboard and pointer devices | Win32 input injection | Implemented |
| Typed pen ("Light") | Wacom driver decodes hardware; AppKit supplies semantic pen events | Separate virtual tablet-tool uinput device | Windows synthetic PT_PEN device |
Implemented and physically tested |
| Native Wacom USB ("Hard") | Root-authorized libusb whole-device capture | usb-vhci virtual host controller and native wacom.ko |
No importer | Lab only; enumeration proven, pen-report retest pending |
0..=8191; tilt maps to whole degrees -90..=90; rotation is not advertised.PT_PEN ceiling 0..=1024; tilt and rotation are supported through Windows Ink.PT_PEN path.
Revision eac2494 captures one exact Intuos5 Touch L
device (056a:0317) on macOS, forwards control and
interrupt URBs over the authenticated QUIC session, and enumerates
native Pen, Pad and Finger devices on Linux through
usb-vhci. The current lab build must run with
administrator authorization. The corrected pending-interrupt behavior
still requires one physical pen-report retest. This is not a
production support claim or a general USB forwarding feature.
Audio
| Direction | Format | Frame | Policy |
|---|---|---|---|
| Workstation to Deck | 48 kHz, stereo, signed 16-bit PCM or Opus | 20 ms | Uncompressed PCM or fixed Opus 128 kbps; target playout latency 60 ms, hard decoded queue bound 200 ms. |
| Deck microphone to Pier | 48 kHz, mono, PCM or negotiated Opus | 20 ms | Off by default. Requires Deck opt-in, macOS permission, negotiated support and host policy. |
The Windows virtual microphone driver source exists but remains default-off pending protected driver signing, HLK/HVCI evidence and release approval. Arcen does not change the Windows default recording endpoint.
Clipboard
1 must be negotiated by both peers.Shared component boundaries
| Crate | Responsibility |
|---|---|
arcen-protocol | Versioned wire messages, framing, auth state, clipboard chunks, monitor-tagged media and Hard USB URBs. |
arcen-input | Absolute/relative pointer semantics, cursor authority, ordered input, typed pen and region-coordinate transforms. |
arcen-media | Codec/chroma/bit-depth contracts, media-plan resolution, video planes, BT.709 conversion, audio policy, clipboard raster conversion and monitor topology. |
arcen-keel | Pure 16 x 16 damage tracking and region activity classification. |
arcen-transport | TLS lifecycle, certificate pins, QUIC carrier contracts and bounded transport queues. |
arcen-usb-bridge | Exact-device policy, descriptor validation, attachment state and URB ledger for the default-off Hard USB lab. |
arcen-licensing | Offline signed licence verification, HostID binding, replacement state and capacity-one admission. |
arcen-observability | Bounded JSON Lines logging, lifecycle events, live profile reload and nonblocking sink workers. |
arcen-telemetry | Correlation IDs, privacy-bounded fields and stable lifecycle/QoS categories. |
arcen-session | Restore leases and session lifecycle contracts; authoritative floating-session features remain dormant. |
Implementation and release status
| Area | State at revision eac2494 |
|---|---|
| Direct macOS Deck to Linux/Windows Pier | Implemented QUIC-only current product path. |
| HEVC 4:4:4 hardware path | Implemented NVIDIA NVENC path; actual capability is probed per GPU. |
| H.264 software fallback | Conditional Windows MF proven on selected virtualized hosts; Linux OpenH264 code complete with release/performance gates open. |
| 1-4 monitor Match My Layout | Implemented on main Per-monitor runtime, topology and measured encoder admission exist; exact hardware plans remain admission-dependent. |
| Typed Wacom pen | Physically tested macOS to Linux and Windows for position, pressure, tilt, proximity, tip, eraser and barrel buttons. |
| Native Wacom USB | Lab only macOS-to-Linux enumeration proven; pen-report retest and production privilege/driver decisions remain open. |
| Offline Pier licensing | Implemented core Host adapters and tests exist, but the production signing-key ring is empty and real startup fails closed until key ceremony and target validation. |
| Windows virtual microphone | Default-off Driver/source path exists; signing, HLK/HVCI and release evidence remain open. |
| Arcen Span | Planned Gateway is not part of the current Direct product. |
| AV1, 10-bit, HDR | Not current No current implementation or product claim. |