Air-Gapped Operation & Blind Push Relay
How mobile push notifications work in self-hosted environments using 128-bit opaque handles and zero-content wake signals.
Zero-Content Wake Architecture (madar-relay)
Mobile operating systems require push notifications to be signed by the app publisher's APNs/FCM credentials. To allow self-hosted workspaces to wake mobile devices without sharing publisher keys or exposing message content, Madar implements a Blind Cloud Relay:
1. The mobile client registers its native FCM/APNs token with the relay (/v1/handles) and receives a 128-bit random opaque handle (rel_<32-hex>).
2. The client gives only this opaque handle to the organization's self-hosted server.
3. When an urgent broadcast or message arrives while the user is offline, the self-hosted server calls POST /v1/wake with its TENANT_TOKEN and the push_handle. The relay strictly rejects any payload containing title, body, message, sender, or channel_name (400 relay_content_violation).
{
"push_handle": "rel_8f02b4c9e1a34d7091b2c3d4e5f60718",
"wake_signal": {
"vault_id": "9f8c2b10-4e11-4d9a-8c31-0a2b3c4d5e6f",
"sync_hint": "urgent",
"priority": "high"
}
}