TraceNetwork

TraceNetwork turns a stack of ZeroTrace devices into a coordinated fleet. One operator drives every device from the mobile app's TraceNet tab over Bluetooth — synchronized script execution, remote file and config admin, fleet-wide WiFi scanning, and animated light shows across the chain. There is no web UI.

Devices discover each other automatically over ESP-NOW (no router or access point required), encrypted with AES-128-GCM keyed off a single shared passphrase. The link is single-hop: every device must be in direct radio range of the one you're connected to.

What you get

• Synchronized script execution. Fire the same HID payload — a file on the agent or an inline script — on every selected device, scheduled with a shared start offset so they act in near-unison. Useful when you've planted units in multiple places.
• Remote admin. List, push, pull, and delete files (safe paths only); read and write an allowlisted set of config keys; run and stop scripts on any agent — all from the app without touching the planted hardware.
• Identify. Blink any device's LED in its configured color (default 5 blinks) so you can physically locate it in a room of identical units.
• Fleet WiFi scan. Ask agents to scan and return the WiFi networks they can hear (up to 20 APs each). Place agents in different rooms for coverage no single device could see.
• Light shows. Synchronized animated lighting across the fleet — off, solid, breathe, blink, rainbow, chase, bounce — with a per-device index offset so patterns choreograph down the chain.
• Heartbeats and telemetry. Each device reports in on a cadence (every ~10 s idle, ~1 s while a script runs) so the fleet view stays current.
• traceBroadcast script command. Emit a labeled presence beacon from inside a script — see the note below on what it does and does not do today.

Security

• All TraceNetwork traffic — heartbeats, commands, file transfers, light shows, broadcasts — is encrypted with AES-128-GCM.
• A single fleet-wide 128-bit key is derived from the configured passphrase via HKDF-SHA256. Every device in the fleet shares that one key.
• Each packet carries a fresh, fully random 96-bit (12-byte) nonce drawn from the hardware RNG.
• A per-sender replay tracker rejects stale or duplicated frames.
• Devices with a mismatched passphrase produce traffic whose authentication tag doesn't verify — receivers drop it silently. Mismatched fleets are mutually invisible.

Constraints

• Single-hop only. There is no mesh forwarding or relay. Every agent must be in direct ESP-NOW range of the device you're driving.
• Channel 1. TraceNetwork pins the radio to WiFi channel 1. WiFi otherwise runs in station mode only (there is no access point).
• Chunked file transfer. Transfers move in ACK-windowed chunks over ESP-NOW — fine for KB-sized scripts, slow for large logs.
• Fleet WiFi scan is refused while a script runs on the target device, since a scan would disrupt HID injection.