Route order
| Route | When Noema uses it | What it means |
|---|---|---|
| Local Network | Both devices can reach each other on the same LAN. | The request goes directly to the Mac on the local network and usually has the lowest latency. |
| Private Link | You configured a reachable Tailscale, ZeroTier, or WireGuard address. | Traffic travels over your private mesh without router port forwarding. |
| Direct | The devices can establish an encrypted peer-to-peer path across networks. | CloudKit introduces the devices, but no relay carries the conversation. |
| Noema Bridge | A restrictive NAT or firewall prevents Direct. | End-to-end encrypted bytes pass through Noema’s relay; the relay cannot read the request or reply. |
| Cloud Relay | Faster routes are unavailable. | Requests and replies use your private CloudKit database. It is the broadest-compatibility and slowest fallback. |
Direct is not guaranteed. Carrier-grade NAT, hotel Wi-Fi, enterprise firewalls, and some mobile networks intentionally prevent peer-to-peer connectivity. Seeing Noema Bridge on 5G can therefore be normal rather than a configuration problem.
See the current route
- Stored → Constellation, under Remote Session.
- The Chat connection button.
- The menu containing the active model’s eject action.
Constellation settings also explain every route. Private Link appears in the route list after one has been configured.
Set up Private Link
- Connect the Mac and requesting device to the same Tailscale, ZeroTier, or WireGuard network.
- Open Stored → Constellation on the requesting device.
- Open the Mac under the lower Private Link section.
- Enter the private address assigned to the Mac.
- Save, then press Use on a Mac model to test the route.
No router port forwarding is required. Noema checks the private address directly and avoids routing that check through a system proxy.
What Noema Bridge can see
Noema Bridge receives an opaque routing token and encrypted traffic. The two devices authenticate the session and encrypt the request and response end-to-end. The bridge forwards sealed bytes and does not run the model or store its weights.
Cloud Relay is a separate fallback. It stores the exchange in the user’s private CloudKit database rather than sending it through the Bridge socket.
Remote Access and Off-Grid Mode
Remote Access is off by default. Enabling it is a deliberate action on both the Mac and requesting device.
Off-Grid Mode takes priority over Constellation. It pauses iCloud sync, discovery, Remote Access, and network-backed tools until the mode is turned off.