perf(mobile): solve enroll PoW natively — fast connect + responsive UI

The enroll anti-flood proof-of-work is ~1M SHA-256 hashes (20-bit difficulty).
Solving it in JS on Hermes takes many seconds AND saturates the single JS
thread, so "Connecting…" dragged, multi-hop (which solved twice, sequentially)
often hit the 40s watchdog ("Connection timed out. Try another location."), and
the UI felt janky mid-connect.

- core: `enroll` accepts an optional `powSolver` override (EnrollOptions).
- Android/iOS: native `solvePow` (Kotlin MessageDigest / Swift CryptoKit) loops
  off the JS thread — ~100x faster, sub-second for 20 bits — mirroring core's
  hasLeadingZeroBits contract exactly. Random start nonce (no replay).
- mobile: `lib/pow.ts` prefers the native solver, falls back to the JS solver
  when absent; single-hop and both multi-hop enrolls use it. The two multi-hop
  enrolls now run concurrently (Promise.all) so their solves overlap.

Also fixes a timing-flaky probe test (inject a clock into pingGateway instead of
measuring real setTimeout jitter).

UI:
- Boot: "Connecting to the decentralized Flux network…" + a "Powered by Flux"
  footer (leads to runonflux.com); same attribution added to Settings.
- Settings tagline: "Decentralized WireGuard VPN on Flux Cloud."
- ConnectScreen is now scrollable with a floored orb area, so on short screens
  the orb no longer overlaps the Fast / Multi-hop toggle.

Author: TheTrunk

clients/core-ts/src/enroll.ts

@@ -24,7 +24,8 @@ export async function enroll(
 ): Promise<EnrollResponse> {
   const fetchImpl = options.fetchImpl ?? globalThis.fetch;
   const bits = options.powBits ?? POW_BITS;
-  const nonce = await solvePoW(publicKeyB64, bits);
+  const solve = options.powSolver ?? solvePoW;
+  const nonce = await solve(publicKeyB64, bits);
 
   const { data } = await fetchSigned<EnrollResponse>(
     `http://${gatewayIp}:${CONTROL_PORT}/v1/enroll`,

clients/core-ts/src/probe.test.ts

@@ -1,44 +1,61 @@
 import { describe, expect, it, vi } from 'vitest';
 import { pingGateway } from './probe.js';
 
-/** A fetch that resolves after `delay` ms with a 200 (or a rejection). */
-function fakeFetch(plan: Array<number | 'fail'>) {
+/** A monotonic virtual clock, advanced by the fake fetch to simulate RTT. */
+function makeClock() {
+  let t = 1000;
+  return { now: () => t, advance: (ms: number) => void (t += ms) };
+}
+
+/**
+ * A fetch that "takes" `step` ms per call by advancing `clock` (or rejects on
+ * `'fail'`). Using a virtual clock instead of real `setTimeout` makes the RTT
+ * each sample records exact — so the summary is deterministic and the test
+ * can't flake on OS timer jitter.
+ */
+function fakeFetch(plan: Array<number | 'fail'>, clock: ReturnType<typeof makeClock>) {
   let i = 0;
   return vi.fn(async () => {
     const step = plan[i++ % plan.length];
     if (step === 'fail') {
       throw new Error('network');
     }
-    await new Promise((r) => setTimeout(r, step));
+    clock.advance(step);
     return { ok: true, arrayBuffer: async () => new ArrayBuffer(0) } as unknown as Response;
   });
 }
 
 describe('pingGateway', () => {
   it('summarises RTT + jitter over samples', async () => {
+    const clock = makeClock();
     const r = await pingGateway('http://x:51821', {
       samples: 3,
-      fetchImpl: fakeFetch([10, 10, 10]),
+      fetchImpl: fakeFetch([10, 10, 10], clock),
+      now: clock.now,
     });
     expect(r.rttMs).not.toBeNull();
     expect(r.loss).toBe(0);
     expect(r.jitterMs).toBe(0); // identical samples → no jitter
   });
 
   it('reports loss when samples fail', async () => {
+    const clock = makeClock();
     const r = await pingGateway('http://x:51821', {
       samples: 4,
-      fetchImpl: fakeFetch(['fail', 'fail', 'fail', 'fail']),
+      fetchImpl: fakeFetch(['fail', 'fail', 'fail', 'fail'], clock),
+      now: clock.now,
     });
     expect(r.rttMs).toBeNull();
     expect(r.jitterMs).toBeNull();
     expect(r.loss).toBe(1);
   });
 
   it('computes partial loss + a non-zero jitter for varied samples', async () => {
+    const clock = makeClock();
     const r = await pingGateway('http://x:51821', {
       samples: 4,
-      fetchImpl: fakeFetch([5, 25, 'fail', 15]),
+      fetchImpl: fakeFetch([5, 25, 'fail', 15], clock),
+      now: clock.now,
     });
     expect(r.loss).toBeCloseTo(0.25, 5);
     expect(r.rttMs).not.toBeNull();

clients/core-ts/src/probe.ts

@@ -22,24 +22,32 @@ export interface PingResult {
  *
  * @param controlUrl - The gateway control base URL, e.g. `http://<ip>:51821`.
  * @param options - `samples` (default 4), `timeoutMs` per sample (default 4000),
- *   and an optional `fetchImpl`.
+ *   an optional `fetchImpl`, and an optional `now` clock (default `Date.now`;
+ *   injectable so tests are deterministic rather than dependent on OS timer
+ *   jitter).
  * @returns Median RTT, jitter, and loss over the samples.
  */
 export async function pingGateway(
   controlUrl: string,
-  options: { samples?: number; timeoutMs?: number; fetchImpl?: FetchImpl } = {},
+  options: {
+    samples?: number;
+    timeoutMs?: number;
+    fetchImpl?: FetchImpl;
+    now?: () => number;
+  } = {},
 ): Promise<PingResult> {
   const samples = Math.max(1, options.samples ?? 4);
   const timeoutMs = options.timeoutMs ?? 4000;
   const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+  const now = options.now ?? Date.now;
 
   const rtts: number[] = [];
   let failures = 0;
 
   for (let i = 0; i < samples; i += 1) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
-    const started = Date.now();
+    const started = now();
     try {
       const res = await fetchImpl(`${controlUrl}/v1/info`, {
         method: 'GET',
@@ -48,7 +56,7 @@ export async function pingGateway(
       // Drain the body so the socket can be reused/closed on all runtimes.
       await res.arrayBuffer().catch(() => undefined);
       if (res.ok) {
-        rtts.push(Date.now() - started);
+        rtts.push(now() - started);
       } else {
         failures += 1;
       }

clients/core-ts/src/types.ts

@@ -131,6 +131,16 @@ export interface EnrollOptions {
   readonly fetchImpl?: FetchImpl;
   /** Proof-of-work difficulty; defaults to {@link POW_BITS}. */
   readonly powBits?: number;
+  /**
+   * Override the proof-of-work solver. The default JS solver runs ~1M SHA-256
+   * hashes on the calling thread — seconds on a phone's Hermes engine, which
+   * both stalls the connect and janks the UI. Native clients pass a solver that
+   * loops in Kotlin/Swift (millions of hashes/sec, off the JS thread), so a
+   * 20-bit solve finishes in well under a second. Must satisfy the same
+   * contract as core `solvePoW` (return a decimal-string nonce whose
+   * `sha256(pubkey||nonce)` has `bits` leading zero bits).
+   */
+  readonly powSolver?: (publicKeyB64: string, bits: number) => Promise<string>;
   /**
    * Pinned gateway signing pubkey (base64). When set, the response signature
    * must verify against it; otherwise the pubkey advertised in the response

clients/mobile/App.tsx

@@ -9,6 +9,7 @@
 import { useEffect, useState } from 'react';
 import { ActivityIndicator, BackHandler, StatusBar, StyleSheet, Text, View } from 'react-native';
 import { SafeAreaProvider, SafeAreaView } from 'react-native-safe-area-context';
+import { PoweredByFlux } from './src/components/PoweredByFlux';
 import { useVpn } from './src/state/useVpn';
 import { ConnectScreen } from './src/screens/ConnectScreen';
 import { CountryPickerScreen } from './src/screens/CountryPickerScreen';
@@ -44,8 +45,13 @@ function App(): React.JSX.Element {
         <View style={styles.screen}>
           {vpn.booting && vpn.countries.length === 0 ? (
             <View style={styles.boot}>
-              <ActivityIndicator color={color.cyan} />
-              <Text style={styles.bootText}>Connecting to the Flux network…</Text>
+              <View style={styles.bootCenter}>
+                <ActivityIndicator color={color.cyan} />
+                <Text style={styles.bootText}>Connecting to the decentralized Flux network…</Text>
+              </View>
+              <View style={styles.bootFooter}>
+                <PoweredByFlux />
+              </View>
             </View>
           ) : route === 'countries' ? (
             <CountryPickerScreen
@@ -106,8 +112,16 @@ const styles = StyleSheet.create({
   // future react-native-linear-gradient pass renders the full 3-stop gradient.
   safe: { flex: 1, backgroundColor: color.sky1 },
   screen: { flex: 1, backgroundColor: color.sky2 },
-  boot: { flex: 1, alignItems: 'center', justifyContent: 'center', gap: 14 },
-  bootText: { color: color.inkDim, fontSize: 14 },
+  boot: { flex: 1 },
+  bootCenter: {
+    flex: 1,
+    alignItems: 'center',
+    justifyContent: 'center',
+    gap: 14,
+    paddingHorizontal: 32,
+  },
+  bootText: { color: color.inkDim, fontSize: 14, textAlign: 'center' },
+  bootFooter: { paddingBottom: 20, alignItems: 'center' },
 });
 
 export default App;

clients/mobile/android/app/src/main/java/com/cumulusvpn/tunnel/CumulusTunnelModule.kt

@@ -4,6 +4,9 @@ import android.app.Activity
 import android.content.Intent
 import android.net.VpnService
 import android.provider.Settings
+import java.security.MessageDigest
+import java.util.concurrent.Executors
+import kotlin.random.Random
 import com.facebook.react.bridge.ActivityEventListener
 import com.facebook.react.bridge.Arguments
 import com.facebook.react.bridge.BaseActivityEventListener
@@ -32,6 +35,11 @@ class CumulusTunnelModule(
 
     private var permissionPromise: Promise? = null
 
+    // A small pool so the two multi-hop enrollments can solve their PoW
+    // concurrently on separate cores instead of serialising. Native SHA-256 is
+    // ~100x the Hermes JS solver, so each 20-bit solve is well under a second.
+    private val powExecutor = Executors.newCachedThreadPool()
+
     private val activityListener: ActivityEventListener =
         object : BaseActivityEventListener() {
             override fun onActivityResult(
@@ -161,6 +169,63 @@ class CumulusTunnelModule(
         activity.startActivityForResult(consent, VPN_PERMISSION_REQUEST)
     }
 
+    /**
+     * solvePow(publicKeyB64, bits): Promise<String>
+     *
+     * Solve the enroll anti-flood proof-of-work natively: find a decimal-string
+     * `nonce` such that `sha256(pubkey||nonce)` has `bits` leading zero bits.
+     * Runs off the JS thread on [powExecutor]; native SHA-256 clears the 20-bit
+     * difficulty in well under a second (the pure-JS Hermes solver takes many
+     * seconds and freezes the UI). Mirrors core `solvePoW`/`hasLeadingZeroBits`.
+     */
+    @ReactMethod
+    fun solvePow(publicKeyB64: String, bits: Double, promise: Promise) {
+        powExecutor.execute {
+            try {
+                promise.resolve(solvePowSync(publicKeyB64, bits.toInt()))
+            } catch (t: Throwable) {
+                promise.reject("E_POW", t.message, t)
+            }
+        }
+    }
+
+    private fun solvePowSync(publicKeyB64: String, bits: Int): String {
+        val md = MessageDigest.getInstance("SHA-256")
+        val pub = publicKeyB64.toByteArray(Charsets.UTF_8)
+        // Random start so repeated solves for the same key yield DIFFERENT valid
+        // nonces — the gateway single-uses each (pubkey, nonce) pair, so a fixed
+        // start would make a re-enroll look like a replay ("bad_pow").
+        var i = Random.nextLong(0, 0x40000000L)
+        while (true) {
+            val nonce = i.toString()
+            md.reset()
+            md.update(pub)
+            md.update(nonce.toByteArray(Charsets.UTF_8))
+            if (hasLeadingZeroBits(md.digest(), bits)) {
+                return nonce
+            }
+            i++
+        }
+    }
+
+    /** True if `digest` starts with at least `bits` zero bits (mirrors core). */
+    private fun hasLeadingZeroBits(digest: ByteArray, bits: Int): Boolean {
+        val full = bits / 8
+        for (k in 0 until full) {
+            if (digest[k].toInt() != 0) {
+                return false
+            }
+        }
+        val rem = bits % 8
+        if (rem != 0) {
+            val mask = (0xff shl (8 - rem)) and 0xff
+            if ((digest[full].toInt() and mask) != 0) {
+                return false
+            }
+        }
+        return true
+    }
+
     // Required for RN's NativeEventEmitter (JS-side addListener/removeListeners).
     @ReactMethod
     fun addListener(eventName: String) {

clients/mobile/ios/CumulusTunnel/CumulusTunnelModule.m

@@ -37,4 +37,9 @@ @interface RCT_EXTERN_MODULE(CumulusTunnel, RCTEventEmitter)
 RCT_EXTERN_METHOD(requestPermission:(RCTPromiseResolveBlock)resolve
                   rejecter:(RCTPromiseRejectBlock)reject)
 
+RCT_EXTERN_METHOD(solvePow:(NSString *)publicKeyB64
+                  bits:(nonnull NSNumber *)bits
+                  resolver:(RCTPromiseResolveBlock)resolve
+                  rejecter:(RCTPromiseRejectBlock)reject)
+
 @end

clients/mobile/ios/CumulusTunnel/CumulusTunnelModule.swift

@@ -9,6 +9,7 @@
 // POC: bodies are scaffolded with the real NetworkExtension calls; the manager
 // save/load flow is outlined but not exhaustively error-handled.
 
+import CryptoKit
 import Foundation
 import NetworkExtension
 import React
@@ -193,6 +194,58 @@ final class CumulusTunnelModule: RCTEventEmitter {
         }
     }
 
+    // solvePow(publicKeyB64, bits): Promise<String>
+    // Solve the enroll anti-flood proof-of-work natively: find a decimal-string
+    // nonce such that sha256(pubkey||nonce) has `bits` leading zero bits. Runs on
+    // a background queue; CryptoKit SHA-256 clears the 20-bit difficulty in well
+    // under a second (the pure-JS Hermes solver takes seconds and freezes the UI).
+    // Mirrors core `solvePoW`/`hasLeadingZeroBits`.
+    @objc(solvePow:bits:resolver:rejecter:)
+    func solvePow(
+        _ publicKeyB64: String,
+        bits: NSNumber,
+        resolver resolve: @escaping RCTPromiseResolveBlock,
+        rejecter reject: @escaping RCTPromiseRejectBlock
+    ) {
+        let n = bits.intValue
+        DispatchQueue.global(qos: .userInitiated).async {
+            resolve(Self.solvePowSync(publicKeyB64, bits: n))
+        }
+    }
+
+    private static func solvePowSync(_ publicKeyB64: String, bits: Int) -> String {
+        let pub = Array(publicKeyB64.utf8)
+        // Random start so repeated solves for the same key yield DIFFERENT valid
+        // nonces (the gateway single-uses each (pubkey, nonce) pair).
+        var i = UInt64.random(in: 0..<0x4000_0000)
+        while true {
+            let nonce = String(i)
+            var buf = pub
+            buf.append(contentsOf: nonce.utf8)
+            if hasLeadingZeroBits(SHA256.hash(data: buf), bits: bits) {
+                return nonce
+            }
+            i += 1
+        }
+    }
+
+    /// True if `digest` starts with at least `bits` zero bits (mirrors core).
+    private static func hasLeadingZeroBits(_ digest: SHA256.Digest, bits: Int) -> Bool {
+        let bytes = Array(digest)
+        let full = bits / 8
+        for k in 0..<full where bytes[k] != 0 {
+            return false
+        }
+        let rem = bits % 8
+        if rem != 0 {
+            let mask = UInt8((0xff << (8 - rem)) & 0xff)
+            if (bytes[full] & mask) != 0 {
+                return false
+            }
+        }
+        return true
+    }
+
     // MARK: - internals
 
     private func loadOrCreateManager(

clients/mobile/src/components/PoweredByFlux.tsx

@@ -0,0 +1,35 @@
+/**
+ * "Powered by Flux" attribution — the app runs on the Flux decentralized cloud.
+ * Tapping it opens runonflux.com. Shown on the boot screen and in Settings.
+ *
+ * A lightweight text mark (no SVG dependency): a small lightning glyph + label,
+ * styled to sit quietly at the bottom of a screen.
+ */
+import { Linking, Pressable, StyleSheet, Text } from 'react-native';
+import { color } from '../theme/tokens';
+
+const FLUX_URL = 'https://runonflux.com';
+
+export function PoweredByFlux({ compact = false }: { compact?: boolean }): React.JSX.Element {
+  return (
+    <Pressable
+      accessibilityRole="link"
+      accessibilityLabel="Powered by Flux — opens runonflux.com"
+      hitSlop={8}
+      onPress={() => void Linking.openURL(FLUX_URL).catch(() => undefined)}
+      style={({ pressed }) => [styles.row, pressed && styles.pressed]}
+    >
+      <Text style={[styles.text, compact && styles.compact]}>
+        Powered by <Text style={styles.brand}>⚡ Flux</Text>
+      </Text>
+    </Pressable>
+  );
+}
+
+const styles = StyleSheet.create({
+  row: { alignItems: 'center', justifyContent: 'center', paddingVertical: 6 },
+  pressed: { opacity: 0.6 },
+  text: { color: color.inkFaint, fontSize: 12, letterSpacing: 0.3 },
+  compact: { fontSize: 11 },
+  brand: { color: color.cyan, fontWeight: '600' },
+});