Constellation and devices
Constellation connections and privacy
Noema tests the available paths when you press Use and selects the best working route before the first message.
Last verified for Noema 3.6. Some details may differ in Noema 4.2.
On this page
Route order
| Route | When Noema uses it | What it means |
|---|---|---|
| Local Network | Both devices can reach each other on the same LAN. | The request goes directly to the Mac on the local network and usually has the lowest latency. |
| Private Link | You configured a reachable Tailscale, ZeroTier, or WireGuard address. | Traffic travels over your private mesh without router port forwarding. |
| Direct | The devices can establish an encrypted peer-to-peer path across networks. | CloudKit introduces the devices, but no relay carries the conversation. |
| Noema Bridge | A restrictive NAT or firewall prevents Direct. | End-to-end encrypted bytes pass through Noema’s relay; the relay cannot read the request or reply. |
| Cloud Relay | Faster routes are unavailable. | Requests and replies use your private CloudKit database. It is the broadest-compatibility and slowest fallback. |
Direct is not guaranteed. Carrier-grade NAT, hotel Wi-Fi, enterprise firewalls, and some mobile networks intentionally prevent peer-to-peer connectivity. Seeing Noema Bridge on 5G can therefore be normal rather than a configuration problem.
See the current route
- Stored → Constellation, under Remote Session.
- The Chat connection button.
- The menu containing the active model’s eject action.
Constellation settings also explain every route. Private Link appears in the route list after one has been configured.
Set up Private Link
- Connect the Mac and requesting device to the same Tailscale, ZeroTier, or WireGuard network.
- Open Stored → Constellation on the requesting device.
- Open the Mac under the lower Private Link section.
- Enter the private address assigned to the Mac.
- Save, then press Use on a Mac model to test the route.
No router port forwarding is required. Noema checks the private address directly and avoids routing that check through a system proxy.
What Noema Bridge can see
Noema Bridge receives an opaque routing token and encrypted traffic. The two devices authenticate the session and encrypt the request and response end-to-end. The bridge forwards sealed bytes and does not run the model or store its weights.
Cloud Relay is a separate fallback. It stores the exchange in the user’s private CloudKit database rather than sending it through the Bridge socket.
Remote Access and Off-Grid Mode
Remote Access is off by default. Enabling it is a deliberate action on both the Mac and requesting device.
Off-Grid Mode takes priority over Constellation. It pauses iCloud sync, discovery, Remote Access, and network-backed tools until the mode is turned off.