Browser Devices

What a browser device is

A browser device is a tab that acts like any other device for as long as it's open. It has its own identity, it's a member, and it sees what the other devices see. It runs the same code a laptop would, built as WebAssembly, which is a way of running ordinary programs inside a web page. You don't install anything, and nothing is left behind.

• It's always a guest. A tab joins with a guest invite, a one-time pass for a device nobody trusts yet. So it can't be a brain (the device that keeps an orchy's records and makes its decisions), hold your data, or see secrets. Think of a visitor at an office: they get a lanyard and a tour, and the keys stay in the drawer.
• It only dials out. A browser can't take incoming connections, so a tab is never a front door (the place an orchy's visitors arrive) and nothing else depends on it.
• It holds nothing. Everything lives in memory. Close the tab and the device is gone.

Try it

Open play.orchy.p6m.onl. Within a couple of seconds your tab solves a small puzzle (that's what keeps the demo free for everyone), gets an invite, and joins. What you're looking at then is the explorer, orchy's own screen for looking around. It's the same one you'd run in a terminal. Press : to open the command bar and try :apps or :events, or use the arrow keys. Your own tab is marked ◀ this tab.

The explorer is read-only. Press whatever you like; you can't break the orchy you're looking at.

How a tab joins

1. A small puzzle. The demo hands your browser a puzzle that takes about a second to solve. For you it's over before the page has loaded. For someone trying to flood the demo with thousands of fake visitors, it's thousands of puzzles to solve.
2. A guest invite. It works once and lasts ten minutes.
3. A sealed handshake. The tab joins the way any device does, over HTTPS (the encrypted connection behind the padlock in your browser). The request and the reply are sealed, so nothing in between can read them or fake them. And before the tab trusts the orchy it reached, it checks it's the one the invite named.
4. A secure connection to the brain. The tab opens a WebSocket (a connection a web page can keep open) to the brain, and the orchy's own encryption (mutual TLS, where each side proves who it is) runs inside that. From then on it's a real member.

What visitors can see, and what they never do

On the public orchy, visitors can see what other visitors are up to: which devices are here, which apps are running, what the orchy decided and why. That's the point of a demo. But before anything reaches your screen it's scrubbed twice, once by the demo and once by your own tab:

• Addresses, keys, file paths, links and long secrets are stripped out of every line of text.
• Device IDs are swapped for short labels.
• Names a visitor picks are cut down to letters, digits and dashes. A name that could pass for the orchy itself (admin, orchy-…) gets renamed, so nobody can pretend to be us.

Run your own app on the demo

Anyone can run a small app on the public orchy for an hour. It runs sealed: inside its own tiny virtual machine with no network at all, so a stranger's code can't reach anything else. Yours included. Get an access key (a password for the command line) and deploy, which is our word for putting an app on an orchy:

$ orchy tools guests token https://play.orchy.p6m.onl
access key: orchy_tok_…
$ orchy deploy . --isolation max -e https://play.orchy.p6m.onl --token <access key>
✓ https://my-app-default.play.orchy.p6m.onl is live

The limits, so there are no surprises: sealed only, three apps at a time, 32 MiB of memory each. After an hour everything goes: the app, the files and facts it stored (facts are small shared notes an app can keep), and your access key. Give your app its own name. You can't replace, stop or remove someone else's. And whoever runs the demo can clear out every guest with one command.

Put the explorer on your own page

Fancy the explorer on your own site? The explorer and the browser device come as one small bundle. Build it, host the files, and add one element to your page:

<div id="orchy-explorer"
data-guest-url="https://play.example.org"
data-feed="https://play.example.org/v1/fabric/public-feed"></div>
<script type="module" src="explorer.js"></script>

make web-explorer builds the bundle (the WebAssembly module, the script that loads it, and a compressed copy of each file) into dist/web/explorer.

Run a public demo orchy of your own

Any orchy can be a public demo. Set ORCHY_DEMO_MODE=1 on each device. From then on it only takes guests whose apps run sealed, hands out guest invites and access keys behind the puzzle, publishes a scrubbed public feed (the list of what's happening that visitors see), and clears guests out when their hour's up. One catch: the devices that run guest apps need /dev/kvm (Linux's built-in virtual machine support).

• Demo runbook: a step-by-step guide to setting one up, the limits, the command that clears every guest, and what isn't built yet.
• Sealed apps: how a stranger's code is kept in its box.
• How the browser device works: the engineering notes, including what a tab can't be.