From 61c56bd4a52b2c29c74e0347d3bfd368b99c2a86 Mon Sep 17 00:00:00 2001
From: Wang <m4n5terrr@gmail.com>
Date: Sat, 29 Aug 2026 11:02:17 +0800
Subject: [PATCH] feat(runtime-host): discover coordination relays
 automatically

Use a bounded IPFS Amino discovery client to supply public Circuit Relay v2 candidates while the main peer endpoint retains reservation authority. Preserve manual relay precedence and publish only accepted reservations.

Generated-by: OpenAI Codex
---
 .../__tests__/runtime-host-management.test.ts |  17 +-
 .../runtime-host-ssh-terminal.test.ts         |  40 ++
 .../src/main/runtime-host-management.ts       |  27 +-
 .../src/main/runtime-host-ssh-terminal.ts     |   7 +
 apps/desktop/src/preload/bridge-contract.d.ts |   2 +
 apps/desktop/src/preload/preload.ts           |   2 +
 .../locales/settings-projects-copy.ts         |  19 +-
 .../runtime-host-management-dialog.tsx        |  58 +-
 .../renderer/styles/settings/runtime-host.css |  30 +
 docs/astryx-surface-file-inventory.md         |   2 +-
 docs/runtime-host-remote-access.md            |  11 +-
 docs/runtime-host-remote-access.zh-CN.md      |   8 +-
 native/runtime-host-peer/Cargo.lock           |  61 ++
 native/runtime-host-peer/Cargo.toml           |   2 +
 native/runtime-host-peer/src/bindings.rs      |  14 +-
 native/runtime-host-peer/src/engine.rs        | 652 +++++++++++++++++-
 .../src/engine/relay_discovery.rs             | 504 ++++++++++++++
 .../RUNTIME_HOST_PEER_DEPENDENCIES.rust.tsv   |   5 +
 .../RUNTIME_HOST_PEER_THIRD_PARTY_NOTICES.txt | 118 +++-
 .../runtime-host-service-manager.test.ts      |  13 +
 packages/cli/src/cli-core.ts                  |  12 +
 packages/cli/src/runtime-host-cli.ts          |  34 +-
 .../runtime-host-peer-management-command.ts   |  16 +-
 .../cli/src/runtime-host-service-command.ts   |   1 +
 ...runtime-host-service-management-command.ts |   2 +
 .../cli/src/runtime-host-setup-command.ts     |   1 +
 .../__tests__/peer-management-frame.test.ts   |   1 +
 .../src/__tests__/peer-native.test.ts         |   2 +
 .../runtime-host/src/client/peer-client.ts    |   8 +-
 packages/runtime-host/src/operator/index.ts   |   1 +
 .../src/operator/managed-deployment.ts        |   1 +
 .../src/operator/peer-management-frame.ts     |   1 +
 .../src/operator/service-management-frame.ts  |   2 +
 packages/runtime-host/src/peer-mesh/owner.ts  |   4 +
 .../runtime-host/src/server/peer-listener.ts  |   1 +
 .../runtime-host/src/transport/peer-native.ts |   9 +
 .../generate-runtime-host-peer-notices.mjs    |   6 +-
 37 files changed, 1635 insertions(+), 59 deletions(-)
 create mode 100644 native/runtime-host-peer/src/engine/relay_discovery.rs

diff --git a/apps/desktop/src/main/__tests__/runtime-host-management.test.ts b/apps/desktop/src/main/__tests__/runtime-host-management.test.ts
index e7d234745f..5e3ee971dd 100644
--- a/apps/desktop/src/main/__tests__/runtime-host-management.test.ts
+++ b/apps/desktop/src/main/__tests__/runtime-host-management.test.ts
@@ -20,7 +20,7 @@
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import {
-  RUNTIME_HOST_OPERATOR_PEER_MANAGEMENT_CAPABILITY,
+  RUNTIME_HOST_OPERATOR_PEER_RELAY_DISCOVERY_CAPABILITY,
   runtimeHostAccessCredentialFingerprint,
   type RuntimeHostServiceManagementFrame,
 } from '@maka/runtime-host/operator';
@@ -937,11 +937,11 @@ test('keeps the SSH profile while adding and removing its managed Direct peer',
       assert.equal(input.action, 'status');
       assert.equal(
         input.capabilityRequest,
-        RUNTIME_HOST_OPERATOR_PEER_MANAGEMENT_CAPABILITY,
+        RUNTIME_HOST_OPERATOR_PEER_RELAY_DISCOVERY_CAPABILITY,
       );
       return {
         ...serviceResult('status'),
-        operatorCapabilities: [RUNTIME_HOST_OPERATOR_PEER_MANAGEMENT_CAPABILITY],
+        operatorCapabilities: [RUNTIME_HOST_OPERATOR_PEER_RELAY_DISCOVERY_CAPABILITY],
       };
     },
     runAccessManagement: async () => assert.fail('access management is not expected'),
@@ -971,9 +971,9 @@ test('keeps the SSH profile while adding and removing its managed Direct peer',
 
   const configure = handlers.get('runtime-host-management:configure-direct-peer');
   assert.ok(configure);
-  const enabled = await configure({}, profile.id, true, []);
+  const enabled = await configure({}, profile.id, true, [], true);
   assert.equal((enabled as { profilePresent: boolean }).profilePresent, true);
-  const disabled = await configure({}, profile.id, false, []);
+  const disabled = await configure({}, profile.id, false, [], true);
   assert.equal((disabled as { profilePresent: boolean }).profilePresent, false);
   assert.deepEqual(actions, ['enable', 'disable']);
 });
@@ -1005,7 +1005,7 @@ test('disables a newly enabled listener when its Desktop profile cannot be commi
       directPeerClientAvailable: true,
       runServiceManagement: async () => ({
         ...serviceResult('status'),
-        operatorCapabilities: [RUNTIME_HOST_OPERATOR_PEER_MANAGEMENT_CAPABILITY],
+        operatorCapabilities: [RUNTIME_HOST_OPERATOR_PEER_RELAY_DISCOVERY_CAPABILITY],
       }),
       runAccessManagement: async () => assert.fail('access management is not expected'),
       runPeerManagement: async (input) => {
@@ -1037,7 +1037,7 @@ test('disables a newly enabled listener when its Desktop profile cannot be commi
     const configure = handlers.get('runtime-host-management:configure-direct-peer');
     assert.ok(configure);
     await assert.rejects(
-      configure({}, 'office', true, []) as Promise<unknown>,
+      configure({}, 'office', true, [], true) as Promise<unknown>,
       failure === 'descriptor' ? /usable direct-peer descriptor/u : /profile store failed/u,
     );
     assert.deepEqual(actions, ['enable', 'disable']);
@@ -1077,13 +1077,14 @@ test('does not invoke peer management when the remote operator lacks its capabil
     state: 'unsupported',
     routeHints: [],
     coordinationRelays: [],
+    automaticRelayDiscovery: false,
     profilePresent: false,
     profileEnabled: false,
     clientAvailable: true,
     managementAvailable: false,
   });
   await assert.rejects(
-    configure({}, 'office', true, []) as Promise<unknown>,
+    configure({}, 'office', true, [], true) as Promise<unknown>,
     /Update this Runtime Host/u,
   );
 });
diff --git a/apps/desktop/src/main/__tests__/runtime-host-ssh-terminal.test.ts b/apps/desktop/src/main/__tests__/runtime-host-ssh-terminal.test.ts
index a08f663a00..614c6db12c 100644
--- a/apps/desktop/src/main/__tests__/runtime-host-ssh-terminal.test.ts
+++ b/apps/desktop/src/main/__tests__/runtime-host-ssh-terminal.test.ts
@@ -27,6 +27,7 @@ import { type RuntimeHostSshProcessFactory } from '@maka/runtime-host/client';
 import {
   encodeRuntimeHostActivationFrame,
   encodeRuntimeHostAccessManagementFrame,
+  encodeRuntimeHostPeerManagementFrame,
   encodeRuntimeHostServiceManagementFrame,
   encodeRuntimeHostSetupFrame,
   encodeRuntimeHostPeerMeshManagementFrame,
@@ -638,6 +639,45 @@ test('keeps a prepared access credential out of the SSH terminal projection', as
   await harness.terminal.close();
 });
 
+test('requests relay-discovery status only on the peer-management frame', async () => {
+  const harness = createHarness('pending');
+  const management = harness.terminal.runPeerManagement({
+    destination: 'operator@example.com',
+    operatorPath: '/home/operator/.local/share/maka/operator',
+    action: 'status',
+    expectedTarget: {
+      serviceId: 'b'.repeat(64),
+      rootPath: '/srv/maka',
+      rootId: 'a'.repeat(64),
+      deploymentId: '00000000-0000-4000-8000-000000000001',
+    },
+  });
+  await waitFor(() => harness.pty.hasDataListener());
+  const command = harness.launchArgs.at(-1)?.at(-1) ?? '';
+  assert.match(command, /peer.*status.*--framed.*--relay-discovery-status/u);
+
+  harness.pty.emitData(
+    encodeRuntimeHostPeerManagementFrame({
+      kind: 'result',
+      action: 'status',
+      status: {
+        state: 'enabled',
+        serviceState: 'running',
+        peerId: '12D3KooWpeer',
+        rootId: 'a'.repeat(64),
+        routeHints: ['/ip4/192.0.2.1/udp/41000/quic-v1'],
+        coordinationRelays: [],
+        automaticRelayDiscovery: true,
+      },
+    }),
+  );
+  harness.pty.exit(0);
+
+  const result = await management;
+  assert.equal(result.kind === 'result' && result.status.automaticRelayDiscovery, true);
+  await harness.terminal.close();
+});
+
 test('sends a Mesh invitation only after the authenticated remote operator requests it', async () => {
   const harness = createHarness('pending');
   const invitation = JSON.stringify({ secret: 'one-time-mesh-secret' });
diff --git a/apps/desktop/src/main/runtime-host-management.ts b/apps/desktop/src/main/runtime-host-management.ts
index c1e82c737f..8b0099619e 100644
--- a/apps/desktop/src/main/runtime-host-management.ts
+++ b/apps/desktop/src/main/runtime-host-management.ts
@@ -20,7 +20,7 @@
 import type { IpcMain } from 'electron';
 import {
   RUNTIME_HOST_OPERATOR_ACCESS_MANAGEMENT_CAPABILITY,
-  RUNTIME_HOST_OPERATOR_PEER_MANAGEMENT_CAPABILITY,
+  RUNTIME_HOST_OPERATOR_PEER_RELAY_DISCOVERY_CAPABILITY,
   isProductReleaseVersion,
   runtimeHostAccessCredentialFingerprint,
   type RuntimeHostManagedUpdatePolicy,
@@ -317,6 +317,7 @@ export function createDesktopRuntimeHostManagement(input: {
       ...(status.peerId ? { peerId: status.peerId } : {}),
       routeHints: status.routeHints,
       coordinationRelays: status.coordinationRelays,
+      automaticRelayDiscovery: status.automaticRelayDiscovery ?? false,
       profilePresent: profile.exists,
       profileEnabled: profile.enabled,
       clientAvailable: input.directPeerClientAvailable,
@@ -334,7 +335,7 @@ export function createDesktopRuntimeHostManagement(input: {
       operatorPath: target.managed.control.operatorPath,
       action: 'status',
       expectedTarget: target.expectedTarget,
-      capabilityRequest: RUNTIME_HOST_OPERATOR_PEER_MANAGEMENT_CAPABILITY,
+      capabilityRequest: RUNTIME_HOST_OPERATOR_PEER_RELAY_DISCOVERY_CAPABILITY,
     });
     if (capability.kind === 'error') throw new Error(capability.error.message);
     if (capability.action !== 'status') {
@@ -343,7 +344,7 @@ export function createDesktopRuntimeHostManagement(input: {
     return {
       ...target,
       available: capability.operatorCapabilities?.includes(
-        RUNTIME_HOST_OPERATOR_PEER_MANAGEMENT_CAPABILITY,
+        RUNTIME_HOST_OPERATOR_PEER_RELAY_DISCOVERY_CAPABILITY,
       ) === true,
     };
   };
@@ -356,6 +357,7 @@ export function createDesktopRuntimeHostManagement(input: {
       state: 'unsupported',
       routeHints: [],
       coordinationRelays: [],
+      automaticRelayDiscovery: false,
       profilePresent: profile.exists,
       profileEnabled: profile.enabled,
       clientAvailable: input.directPeerClientAvailable,
@@ -390,11 +392,15 @@ export function createDesktopRuntimeHostManagement(input: {
     profileIdValue: unknown,
     enabledValue: unknown,
     coordinationRelaysValue: unknown,
+    automaticRelayDiscoveryValue: unknown,
   ): Promise<DesktopRuntimeHostDirectPeerSnapshot> => {
     if (typeof enabledValue !== 'boolean') {
       throw new Error('Runtime Host direct-peer state is invalid');
     }
     const coordinationRelays = requireCoordinationRelays(coordinationRelaysValue);
+    if (typeof automaticRelayDiscoveryValue !== 'boolean') {
+      throw new Error('Runtime Host relay discovery state is invalid');
+    }
     const { profileId, managed, transport, expectedTarget, available } =
       await peerManagementTarget(profileIdValue);
     if (!available) {
@@ -410,6 +416,7 @@ export function createDesktopRuntimeHostManagement(input: {
       operatorPath: managed.control.operatorPath,
       action: enabledValue ? 'enable' : 'disable',
       ...(enabledValue ? { coordinationRelays } : {}),
+      ...(enabledValue ? { automaticRelayDiscovery: automaticRelayDiscoveryValue } : {}),
       expectedTarget,
     });
     if (response.kind !== 'result') {
@@ -829,8 +836,18 @@ export function createDesktopRuntimeHostManagement(input: {
     getDirectPeer(profileId));
   input.ipcMain.handle(
     channels.configureDirectPeer,
-    (_event, profileId: unknown, enabled: unknown, coordinationRelays: unknown) =>
-      configureDirectPeer(profileId, enabled, coordinationRelays),
+    (
+      _event,
+      profileId: unknown,
+      enabled: unknown,
+      coordinationRelays: unknown,
+      automaticRelayDiscovery: unknown,
+    ) => configureDirectPeer(
+      profileId,
+      enabled,
+      coordinationRelays,
+      automaticRelayDiscovery,
+    ),
   );
 
   return {
diff --git a/apps/desktop/src/main/runtime-host-ssh-terminal.ts b/apps/desktop/src/main/runtime-host-ssh-terminal.ts
index daa5b28754..ed1c216868 100644
--- a/apps/desktop/src/main/runtime-host-ssh-terminal.ts
+++ b/apps/desktop/src/main/runtime-host-ssh-terminal.ts
@@ -174,6 +174,7 @@ export interface DesktopRuntimeHostSshPeerManagementInput {
   readonly operatorPath: string;
   readonly action: Extract<RuntimeHostPeerManagementAction, 'enable' | 'disable' | 'status'>;
   readonly coordinationRelays?: readonly string[];
+  readonly automaticRelayDiscovery?: boolean;
   readonly expectedTarget: DesktopRuntimeHostSshManagementInput['expectedTarget'];
   readonly signal?: AbortSignal;
 }
@@ -1343,11 +1344,17 @@ function runtimeHostPeerManagementRemoteCommand(
     'peer',
     input.action,
     '--framed',
+    '--relay-discovery-status',
     ...(input.action === 'enable' && input.coordinationRelays
       ? input.coordinationRelays.length === 0
         ? ['--clear-coordination-relays']
         : input.coordinationRelays.flatMap((relay) => ['--coordination-relay', relay])
       : []),
+    ...(input.action === 'enable' && input.automaticRelayDiscovery !== undefined
+      ? [input.automaticRelayDiscovery
+          ? '--automatic-relay-discovery'
+          : '--no-automatic-relay-discovery']
+      : []),
     ...managedServiceTargetArgs(input.expectedTarget),
   ].map(quotePosix).join(' ');
   return `exec "\${SHELL:-/bin/sh}" -lic ${quotePosix(`exec ${command}`)}`;
diff --git a/apps/desktop/src/preload/bridge-contract.d.ts b/apps/desktop/src/preload/bridge-contract.d.ts
index e5f9f1e5f1..85c431907e 100644
--- a/apps/desktop/src/preload/bridge-contract.d.ts
+++ b/apps/desktop/src/preload/bridge-contract.d.ts
@@ -514,6 +514,7 @@ export interface DesktopRuntimeHostDirectPeerSnapshot {
   readonly peerId?: string;
   readonly routeHints: readonly string[];
   readonly coordinationRelays: readonly string[];
+  readonly automaticRelayDiscovery: boolean;
   readonly profilePresent: boolean;
   readonly profileEnabled: boolean;
   readonly clientAvailable: boolean;
@@ -731,6 +732,7 @@ export interface MakaBridge {
       profileId: string,
       enabled: boolean,
       coordinationRelays: readonly string[],
+      automaticRelayDiscovery: boolean,
     ): Promise<DesktopRuntimeHostDirectPeerSnapshot>;
     listCredentials(profileId: string): Promise<DesktopRuntimeHostAccessSnapshot>;
     rotateCredential(profileId: string): Promise<DesktopRuntimeHostAccessSnapshot>;
diff --git a/apps/desktop/src/preload/preload.ts b/apps/desktop/src/preload/preload.ts
index 63c7344366..c21d120bff 100644
--- a/apps/desktop/src/preload/preload.ts
+++ b/apps/desktop/src/preload/preload.ts
@@ -1349,12 +1349,14 @@ const makaBridge = {
       profileId: string,
       enabled: boolean,
       coordinationRelays: readonly string[],
+      automaticRelayDiscovery: boolean,
     ) {
       return ipcRenderer.invoke(
         'runtime-host-management:configure-direct-peer',
         profileId,
         enabled,
         coordinationRelays,
+        automaticRelayDiscovery,
       );
     },
     listCredentials(profileId: string): Promise<DesktopRuntimeHostAccessSnapshot> {
diff --git a/apps/desktop/src/renderer/locales/settings-projects-copy.ts b/apps/desktop/src/renderer/locales/settings-projects-copy.ts
index 84ed7af676..93b2e00435 100644
--- a/apps/desktop/src/renderer/locales/settings-projects-copy.ts
+++ b/apps/desktop/src/renderer/locales/settings-projects-copy.ts
@@ -134,6 +134,9 @@ export type SettingsProjectsCopy = {
     directPeerRoutes: string;
     directPeerCoordinationRelays: string;
     directPeerCoordinationRelaysPlaceholder: string;
+    directPeerAdvancedCoordination: string;
+    directPeerAutomaticRelayDiscovery: string;
+    directPeerAutomaticRelayDiscoveryHelp: string;
     directPeerEnable: string;
     directPeerDisable: string;
     directPeerAddProfile: string;
@@ -298,7 +301,7 @@ const SETTINGS_PROJECTS_COPY_BY_LOCALE = {
       useConnectionCode: '使用连接码',
       configureManually: '手动配置',
       thisComputerRemoteAccess: '远程访问',
-      thisComputerRemoteAccessHelp: '让其他 Maka Desktop 通过实验性 Direct peer 连接此 Host',
+      thisComputerRemoteAccessHelp: '通过实验性端到端直连访问此 Host；可自动发现公共协调节点来辅助打洞',
       remoteAccessOn: '已开启',
       remoteAccessOff: '未开启',
       enableRemoteAccess: '开启',
@@ -407,7 +410,7 @@ const SETTINGS_PROJECTS_COPY_BY_LOCALE = {
         failed: '启动失败',
       },
       directPeer: 'Direct peer（实验性）',
-      directPeerDescription: '创建独立的实验性 Direct profile。受限 NAT 或被阻止的 UDP 可能使其不可达，且不会自动回退；保留 SSH profile 用于手动恢复。',
+      directPeerDescription: '创建独立的实验性 Direct profile。可自动发现或手动指定协调节点来辅助打洞；受限 NAT 或被阻止的 UDP 仍可能使其不可达，且不会回退到中继传输。保留 SSH profile 用于手动恢复。',
       directPeerState: {
         unsupported: '需要更新',
         not_configured: '未配置',
@@ -423,6 +426,10 @@ const SETTINGS_PROJECTS_COPY_BY_LOCALE = {
       directPeerRoutes: '可用路径',
       directPeerCoordinationRelays: '连接协调节点（可选）',
       directPeerCoordinationRelaysPlaceholder: '多个地址用逗号分隔',
+      directPeerAdvancedCoordination: '手动设置协调节点',
+      directPeerAutomaticRelayDiscovery: '自动发现协调节点',
+      directPeerAutomaticRelayDiscoveryHelp:
+        '协调节点使用 Circuit Relay v2 协议，仅帮助建立端到端直连，不承载应用流量。Maka 会通过公共 IPFS 网络尽力发现可用节点；手动设置的节点优先。',
       directPeerEnable: '启用并添加',
       directPeerDisable: '停用',
       directPeerAddProfile: '添加到 Desktop',
@@ -587,7 +594,7 @@ const SETTINGS_PROJECTS_COPY_BY_LOCALE = {
       useConnectionCode: 'Use connection code',
       configureManually: 'Configure manually',
       thisComputerRemoteAccess: 'Remote access',
-      thisComputerRemoteAccessHelp: 'Let another Maka Desktop reach this Host through experimental Direct peer',
+      thisComputerRemoteAccessHelp: 'Reach this Host through experimental end-to-end direct connections, with automatic public coordination discovery',
       remoteAccessOn: 'On',
       remoteAccessOff: 'Off',
       enableRemoteAccess: 'Enable',
@@ -696,7 +703,7 @@ const SETTINGS_PROJECTS_COPY_BY_LOCALE = {
         failed: 'Failed',
       },
       directPeer: 'Direct peer (experimental)',
-      directPeerDescription: 'Create an independent experimental Direct profile. Restrictive NAT or blocked UDP may make it unreachable, and it does not fall back automatically; keep the SSH profile for manual recovery.',
+      directPeerDescription: 'Create an independent experimental Direct profile. Discover coordination peers automatically or provide them manually to assist hole punching; restrictive NAT or blocked UDP may still make it unreachable, and traffic does not fall back to a relay. Keep the SSH profile for manual recovery.',
       directPeerState: {
         unsupported: 'Update required',
         not_configured: 'Not configured',
@@ -712,6 +719,10 @@ const SETTINGS_PROJECTS_COPY_BY_LOCALE = {
       directPeerRoutes: 'Routes',
       directPeerCoordinationRelays: 'Connection coordination peers (optional)',
       directPeerCoordinationRelaysPlaceholder: 'Separate multiple addresses with commas',
+      directPeerAdvancedCoordination: 'Set coordination peers manually',
+      directPeerAutomaticRelayDiscovery: 'Discover coordination peers automatically',
+      directPeerAutomaticRelayDiscoveryHelp:
+        'Coordination peers use Circuit Relay v2 only to establish an end-to-end direct connection; they never carry application traffic. Maka discovers candidates through the public IPFS network on a best-effort basis, while manually configured peers remain preferred.',
       directPeerEnable: 'Enable and add',
       directPeerDisable: 'Disable',
       directPeerAddProfile: 'Add to Desktop',
diff --git a/apps/desktop/src/renderer/settings/runtime-host-management-dialog.tsx b/apps/desktop/src/renderer/settings/runtime-host-management-dialog.tsx
index 951d391bea..ffa18efe57 100644
--- a/apps/desktop/src/renderer/settings/runtime-host-management-dialog.tsx
+++ b/apps/desktop/src/renderer/settings/runtime-host-management-dialog.tsx
@@ -21,10 +21,13 @@ import { useEffect, useLayoutEffect, useRef, useState } from 'react';
 import { Dialog, DialogHeader } from '@astryxdesign/core/Dialog';
 import { Layout, LayoutContent, LayoutFooter } from '@astryxdesign/core/Layout';
 import { Text } from '@astryxdesign/core/Text';
+import { Switch } from '@astryxdesign/core/Switch';
+import { Tooltip } from '@astryxdesign/core/Tooltip';
 import {
   Badge,
   Banner,
   Button,
+  IconButton,
   MoreMenu,
   Selector,
   Spinner,
@@ -32,6 +35,7 @@ import {
   useToast,
   useUiLocale,
 } from '@maka/ui';
+import { HelpCircle, ICON_SIZE } from '@maka/ui/icons';
 import { uiLocaleToIntlLocale, type UiLocale } from '@maka/core/ui-locale';
 import type { RemoteRuntimeHostProfile } from '@maka/runtime-host/client';
 import type {
@@ -101,6 +105,7 @@ export function RuntimeHostManagementDialog(props: {
   const [directPeer, setDirectPeer] = useState<DesktopRuntimeHostDirectPeerSnapshot>();
   const [directPeerError, setDirectPeerError] = useState<string>();
   const [coordinationRelays, setCoordinationRelays] = useState('');
+  const [automaticRelayDiscovery, setAutomaticRelayDiscovery] = useState(true);
   const nextDirectoryRootId = useRef(1);
   const logsRef = useRef<HTMLPreElement>(null);
 
@@ -213,6 +218,7 @@ export function RuntimeHostManagementDialog(props: {
   function applyDirectPeer(snapshot: DesktopRuntimeHostDirectPeerSnapshot): void {
     setDirectPeer(snapshot);
     setCoordinationRelays(snapshot.coordinationRelays.join(', '));
+    setAutomaticRelayDiscovery(snapshot.automaticRelayDiscovery);
     setDirectPeerError(undefined);
   }
 
@@ -243,6 +249,7 @@ export function RuntimeHostManagementDialog(props: {
           profile.id,
           enabled,
           relays,
+          automaticRelayDiscovery,
         ),
       );
     } catch (failure) {
@@ -730,17 +737,46 @@ export function RuntimeHostManagementDialog(props: {
                               />
                             </dl>
                           ) : null}
-                          <TextInput
-                            label={copy.directPeerCoordinationRelays}
-                            value={coordinationRelays}
-                            placeholder={copy.directPeerCoordinationRelaysPlaceholder}
-                            isDisabled={
-                              loading ||
-                              directPeer.profileEnabled ||
-                              directPeer.state === 'enabled'
-                            }
-                            onChange={setCoordinationRelays}
-                          />
+                          <div className="settingsRuntimeHostDirectPeerDiscovery">
+                            <div className="settingsRuntimeHostDirectPeerDiscoveryLabel">
+                              <Text type="body" weight="semibold">
+                                {copy.directPeerAutomaticRelayDiscovery}
+                              </Text>
+                              <Tooltip content={copy.directPeerAutomaticRelayDiscoveryHelp}>
+                                <IconButton
+                                  label={copy.directPeerAutomaticRelayDiscoveryHelp}
+                                  icon={<HelpCircle size={ICON_SIZE.control} aria-hidden="true" />}
+                                  variant="ghost"
+                                  size="sm"
+                                />
+                              </Tooltip>
+                            </div>
+                            <Switch
+                              label={copy.directPeerAutomaticRelayDiscovery}
+                              isLabelHidden
+                              value={automaticRelayDiscovery}
+                              isDisabled={
+                                loading ||
+                                directPeer.profileEnabled ||
+                                directPeer.state === 'enabled'
+                              }
+                              onChange={setAutomaticRelayDiscovery}
+                            />
+                          </div>
+                          <details className="settingsRuntimeHostDirectPeerAdvanced">
+                            <summary>{copy.directPeerAdvancedCoordination}</summary>
+                            <TextInput
+                              label={copy.directPeerCoordinationRelays}
+                              value={coordinationRelays}
+                              placeholder={copy.directPeerCoordinationRelaysPlaceholder}
+                              isDisabled={
+                                loading ||
+                                directPeer.profileEnabled ||
+                                directPeer.state === 'enabled'
+                              }
+                              onChange={setCoordinationRelays}
+                            />
+                          </details>
                           <div className="settingsRuntimeHostUpdatePolicyActions">
                             <Button
                               variant="secondary"
diff --git a/apps/desktop/src/renderer/styles/settings/runtime-host.css b/apps/desktop/src/renderer/styles/settings/runtime-host.css
index 4425f94df2..95b3cebcba 100644
--- a/apps/desktop/src/renderer/styles/settings/runtime-host.css
+++ b/apps/desktop/src/renderer/styles/settings/runtime-host.css
@@ -177,6 +177,36 @@
   justify-content: flex-end;
 }
 
+.settingsRuntimeHostDirectPeerDiscovery {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: var(--space-3);
+}
+
+.settingsRuntimeHostDirectPeerDiscovery > div {
+  display: flex;
+  align-items: center;
+  gap: var(--space-1);
+  min-width: 0;
+}
+
+.settingsRuntimeHostDirectPeerAdvanced {
+  display: grid;
+  gap: var(--space-2);
+}
+
+.settingsRuntimeHostDirectPeerAdvanced summary {
+  width: fit-content;
+  color: var(--foreground-secondary);
+  cursor: pointer;
+  font: var(--maka-text-supporting);
+}
+
+.settingsRuntimeHostDirectPeerAdvanced[open] summary {
+  margin-bottom: var(--space-2);
+}
+
 .settingsRuntimeHostManagementLogs {
   overflow-wrap: anywhere;
   color: var(--foreground-secondary);
diff --git a/docs/astryx-surface-file-inventory.md b/docs/astryx-surface-file-inventory.md
index d13143bab6..8be11cb333 100644
--- a/docs/astryx-surface-file-inventory.md
+++ b/docs/astryx-surface-file-inventory.md
@@ -102,7 +102,7 @@ Wiki bar: Design Conventions · API Use-the-System · Theming · Container Paddi
 | `apps/desktop/src/renderer/settings/request-customization-editor.tsx` | settings-module | Button, HStack, IconButton, Text, VStack | aligned — uses Astryx (Button, HStack, IconButton, Text, VStack) | aligned |
 | `apps/desktop/src/renderer/settings/runtime-host-connection-code-dialog.tsx` | settings-module | Button, Dialog, DialogHeader, Layout, LayoutContent | aligned — uses Astryx (Button, Dialog, DialogHeader, Layout, LayoutContent) | aligned |
 | `apps/desktop/src/renderer/settings/runtime-host-interaction-boundary.tsx` | settings-module | none | aligned — no raw controls; no Astryx JSX usage | aligned |
-| `apps/desktop/src/renderer/settings/runtime-host-management-dialog.tsx` | settings-module | Badge, Banner, Button, Dialog, DialogHeader, Layout, LayoutContent, Selector, Spinner, Text | aligned — uses Astryx (Badge, Banner, Button, Dialog, DialogHeader, Layout, LayoutContent, Selector) | aligned |
+| `apps/desktop/src/renderer/settings/runtime-host-management-dialog.tsx` | settings-module | Badge, Banner, Button, Dialog, DialogHeader, IconButton, Layout, LayoutContent, Selector, Spinner, Switch, Text, Tooltip | aligned — uses Astryx (Badge, Banner, Button, Dialog, DialogHeader, IconButton, Layout, LayoutContent) | aligned |
 | `apps/desktop/src/renderer/settings/runtime-host-onboarding-dialog.tsx` | settings-module | Banner, Button, Dialog, DialogHeader, Layout, LayoutContent, SegmentedControl, SegmentedControlItem, Selector, Spinner, Text | aligned — uses Astryx (Banner, Button, Dialog, DialogHeader, Layout, LayoutContent, SegmentedControl, SegmentedControlItem) | aligned |
 | `apps/desktop/src/renderer/settings/runtime-host-peer-mesh-dialog.tsx` | settings-module | Badge, Banner, Button, Dialog, DialogHeader, HStack, Layout, LayoutContent | aligned — uses Astryx (Badge, Banner, Button, Dialog, DialogHeader, HStack, Layout, LayoutContent) | aligned |
 | `apps/desktop/src/renderer/settings/runtime-host-profiles-section.tsx` | settings-module | Badge, Banner, Button, HStack, List, ListItem, SegmentedControl, SegmentedControlItem, Selector, Switch | aligned — uses Astryx (Badge, Banner, Button, HStack, List, ListItem, SegmentedControl, SegmentedControlItem) | aligned |
diff --git a/docs/runtime-host-remote-access.md b/docs/runtime-host-remote-access.md
index c98fe30fff..a7648a5d88 100644
--- a/docs/runtime-host-remote-access.md
+++ b/docs/runtime-host-remote-access.md
@@ -131,8 +131,15 @@ service uninstall removes its key while retaining the State Root. Pass
 `peer enable --clear-coordination-relays` to remove every configured coordination relay.
 
 This direct-only path is experimental and may fail on restrictive NAT or UDP-blocked networks. It
-does not replace an existing TLS, SSH, or overlay-network fallback and does not use a public relay
-unless one is explicitly configured with `peer enable --coordination-relay`.
+does not replace an existing TLS, SSH, or overlay-network fallback. By default, the Host uses a
+bounded client-only view of the public IPFS DHT to discover Circuit Relay v2 candidates and fills a
+target of two accepted reservations after accounting for manual relays. Manually configured relays
+remain preferred. Disable or restore this
+best-effort discovery with `peer enable --no-automatic-relay-discovery` or
+`peer enable --automatic-relay-discovery`; disabling it leaves manual relays intact. Public peers can
+observe the discovery connection and may refuse or drop reservations. Only accepted reservations
+are advertised to Mesh peers, and Maka still requires the application stream to upgrade to a direct
+connection instead of carrying Session traffic through the relay.
 
 ### Direct TLS
 
diff --git a/docs/runtime-host-remote-access.zh-CN.md b/docs/runtime-host-remote-access.zh-CN.md
index a90aa21497..075dfd0bf1 100644
--- a/docs/runtime-host-remote-access.zh-CN.md
+++ b/docs/runtime-host-remote-access.zh-CN.md
@@ -117,8 +117,12 @@ PeerId 和 listener 配置；`peer rotate` 会明确更换 PeerId；卸载 servi
 Root。执行 `peer enable --clear-coordination-relays` 可以删除所有已配置的 coordination relay。
 
 Direct-only 路径仍是实验能力，在受限 NAT 或禁用 UDP 的网络中可能失败。它不会替代已有的 TLS、SSH
-或 overlay network fallback；除非用户在 `peer enable` 时明确传入 `--coordination-relay`，否则不会使用
-公共 relay。
+或 overlay network fallback。Host 默认通过公共 IPFS DHT 的有界 client-only 视图发现 Circuit Relay v2
+候选；扣除手动 relay 后，自动池会补足两个已接受 reservation 的目标。手动配置的 relay 始终优先。使用
+`peer enable --no-automatic-relay-discovery` 可以关闭这项尽力而为的发现，使用
+`peer enable --automatic-relay-discovery` 可以重新开启；关闭不会删除手动 relay。公网 Peer 能观察到发现
+连接，也可能拒绝或中止 reservation。只有已接受的 reservation 才会向 Mesh Peer 发布，Maka 仍要求
+application stream 升级为直连，不会通过 relay 传输 Session traffic。
 
 ### Direct TLS
 
diff --git a/native/runtime-host-peer/Cargo.lock b/native/runtime-host-peer/Cargo.lock
index 12bcd90ac3..ca3fffa36f 100644
--- a/native/runtime-host-peer/Cargo.lock
+++ b/native/runtime-host-peer/Cargo.lock
@@ -88,6 +88,12 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "asn1_der"
+version = "0.7.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4858a9d740c5007a9069007c3b4e91152d0506f13c1b31dd49051fd537656156"
+
 [[package]]
 name = "async-io"
 version = "2.6.0"
@@ -401,6 +407,12 @@ version = "0.8.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
 
+[[package]]
+name = "crunchy"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
+
 [[package]]
 name = "crypto-common"
 version = "0.1.7"
@@ -886,6 +898,12 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
 
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
 [[package]]
 name = "hickory-proto"
 version = "0.25.2"
@@ -1299,6 +1317,7 @@ dependencies = [
  "libp2p-dns",
  "libp2p-identify",
  "libp2p-identity",
+ "libp2p-kad",
  "libp2p-mdns",
  "libp2p-metrics",
  "libp2p-noise",
@@ -1427,18 +1446,47 @@ version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9525f3831544f7ae497bde79adf114ef127b0fbbb97edbbf692a80408636421c"
 dependencies = [
+ "asn1_der",
  "bs58",
  "ed25519-dalek",
  "hkdf",
  "multihash",
  "prost",
  "rand 0.8.8",
+ "ring",
  "sha2",
  "thiserror 2.0.20",
  "tracing",
  "zeroize",
 ]
 
+[[package]]
+name = "libp2p-kad"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13d3fd632a5872ec804d37e7413ceea20588f69d027a0fa3c46f82574f4dee60"
+dependencies = [
+ "asynchronous-codec",
+ "bytes",
+ "either",
+ "fnv",
+ "futures",
+ "futures-bounded",
+ "futures-timer",
+ "libp2p-core",
+ "libp2p-identity",
+ "libp2p-swarm",
+ "quick-protobuf",
+ "quick-protobuf-codec",
+ "rand 0.8.8",
+ "sha2",
+ "smallvec",
+ "thiserror 2.0.20",
+ "tracing",
+ "uint",
+ "web-time",
+]
+
 [[package]]
 name = "libp2p-mdns"
 version = "0.48.0"
@@ -1469,6 +1517,7 @@ dependencies = [
  "libp2p-dcutr",
  "libp2p-identify",
  "libp2p-identity",
+ "libp2p-kad",
  "libp2p-ping",
  "libp2p-relay",
  "libp2p-swarm",
@@ -2947,6 +2996,18 @@ version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
 
+[[package]]
+name = "uint"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f9227a75a5a540a464c832ad4a4195dbdbecd8787610a56262721fde6f04f90"
+dependencies = [
+ "byteorder",
+ "crunchy",
+ "hex",
+ "static_assertions",
+]
+
 [[package]]
 name = "unicode-ident"
 version = "1.0.24"
diff --git a/native/runtime-host-peer/Cargo.toml b/native/runtime-host-peer/Cargo.toml
index 5b086ce9d6..01e367934e 100644
--- a/native/runtime-host-peer/Cargo.toml
+++ b/native/runtime-host-peer/Cargo.toml
@@ -32,11 +32,13 @@ libp2p = { version = "0.56", features = [
   "dcutr",
   "dns",
   "identify",
+  "kad",
   "macros",
   "noise",
   "ping",
   "quic",
   "relay",
+  "rsa",
   "tcp",
   "tokio",
   "yamux",
diff --git a/native/runtime-host-peer/src/bindings.rs b/native/runtime-host-peer/src/bindings.rs
index ced2d68479..9379a8b35d 100644
--- a/native/runtime-host-peer/src/bindings.rs
+++ b/native/runtime-host-peer/src/bindings.rs
@@ -19,7 +19,7 @@
 
 use std::{
     path::PathBuf,
-    sync::{Arc, Mutex},
+    sync::{Arc, Mutex, RwLock},
     time::Duration,
 };
 
@@ -39,6 +39,7 @@ pub struct StartPeerEndpointOptions {
     pub expected_peer_id: Option<String>,
     pub listen_addresses: Option<Vec<String>>,
     pub coordination_relays: Option<Vec<String>>,
+    pub automatic_relay_discovery: Option<bool>,
 }
 
 #[napi(object)]
@@ -60,6 +61,7 @@ pub struct PeerIdentitySignature {
 pub struct PeerEndpoint {
     peer_id: String,
     listen_addresses: Vec<String>,
+    active_coordination_relays: Arc<RwLock<Vec<Multiaddr>>>,
     commands: mpsc::Sender<EngineCommand>,
     incoming: Arc<AsyncMutex<mpsc::Receiver<engine::PeerStream>>>,
     mesh_incoming: Arc<AsyncMutex<mpsc::Receiver<engine::PeerStream>>>,
@@ -79,6 +81,14 @@ impl PeerEndpoint {
         self.listen_addresses.clone()
     }
 
+    #[napi(getter)]
+    pub fn active_coordination_relays(&self) -> Vec<String> {
+        self.active_coordination_relays
+            .read()
+            .map(|addresses| addresses.iter().map(ToString::to_string).collect())
+            .unwrap_or_default()
+    }
+
     #[napi]
     pub async fn connect(&self, options: ConnectPeerOptions) -> Result<PeerStream> {
         connect_peer(self, options, engine::StreamKind::Application).await
@@ -283,6 +293,7 @@ pub fn start_peer_endpoint(options: StartPeerEndpointOptions) -> Result<PeerEndp
             options.coordination_relays.unwrap_or_default(),
             "coordination relay",
         )?,
+        automatic_relay_discovery: options.automatic_relay_discovery.unwrap_or(false),
     })
     .map_err(peer_error)?;
     Ok(PeerEndpoint {
@@ -292,6 +303,7 @@ pub fn start_peer_endpoint(options: StartPeerEndpointOptions) -> Result<PeerEndp
             .into_iter()
             .map(|address| address.to_string())
             .collect(),
+        active_coordination_relays: started.active_coordination_relays,
         commands: started.commands,
         incoming: Arc::new(AsyncMutex::new(started.incoming)),
         mesh_incoming: Arc::new(AsyncMutex::new(started.mesh_incoming)),
diff --git a/native/runtime-host-peer/src/engine.rs b/native/runtime-host-peer/src/engine.rs
index 7b33d11a9b..5adef1751b 100644
--- a/native/runtime-host-peer/src/engine.rs
+++ b/native/runtime-host-peer/src/engine.rs
@@ -20,6 +20,7 @@
 use std::{
     collections::{HashMap, HashSet},
     path::PathBuf,
+    sync::{Arc, RwLock},
     thread,
     time::{Duration, Instant},
 };
@@ -43,6 +44,7 @@ mod address;
 mod application_stream;
 mod identity_store;
 mod peer_stream;
+mod relay_discovery;
 
 use address::{
     address_with_expected_peer, address_with_peer, coordination_relay_peer_id, is_relayed_address,
@@ -64,7 +66,11 @@ const MAX_ESTABLISHED_CONNECTIONS: u32 = 1024;
 const MAX_CONNECTIONS_PER_PEER: u32 = 4;
 const LISTENER_ADDRESS_QUIET_PERIOD: Duration = Duration::from_millis(250);
 const COORDINATION_RETRY_INTERVAL: Duration = Duration::from_secs(1);
+const AUTOMATIC_RELAY_COOLDOWN: Duration = Duration::from_secs(30);
 const IDLE_CONNECTION_TIMEOUT: Duration = Duration::from_secs(10);
+const TARGET_COORDINATION_RESERVATIONS: usize = 2;
+const MAX_AUTOMATIC_RELAY_CANDIDATES: usize = 8;
+const MAX_RELAY_ADDRESSES_PER_PEER: usize = 4;
 
 #[derive(Clone)]
 pub struct StartOptions {
@@ -72,11 +78,13 @@ pub struct StartOptions {
     pub expected_peer_id: Option<PeerId>,
     pub listen_addresses: Vec<Multiaddr>,
     pub coordination_relays: Vec<Multiaddr>,
+    pub automatic_relay_discovery: bool,
 }
 
 pub struct StartedEndpoint {
     pub peer_id: PeerId,
     pub listen_addresses: Vec<Multiaddr>,
+    pub active_coordination_relays: Arc<RwLock<Vec<Multiaddr>>>,
     pub commands: mpsc::Sender<EngineCommand>,
     pub incoming: mpsc::Receiver<PeerStream>,
     pub mesh_incoming: mpsc::Receiver<PeerStream>,
@@ -178,11 +186,14 @@ struct DirectConnectState {
 
 struct CoordinationRelay {
     addresses: Vec<Multiaddr>,
+    automatic_addresses: Vec<Multiaddr>,
+    reservation_addresses: Vec<Multiaddr>,
     connections: HashSet<ConnectionId>,
     pending_connection: Option<ConnectionId>,
     identify_received: bool,
     identify_sent: bool,
     reserve: bool,
+    reservation_accepted: bool,
     client_references: usize,
     reservation_listener: Option<ListenerId>,
     next_connection_attempt: Instant,
@@ -194,11 +205,14 @@ impl Default for CoordinationRelay {
         let now = Instant::now();
         Self {
             addresses: Vec::new(),
+            automatic_addresses: Vec::new(),
+            reservation_addresses: Vec::new(),
             connections: HashSet::new(),
             pending_connection: None,
             identify_received: false,
             identify_sent: false,
             reserve: false,
+            reservation_accepted: false,
             client_references: 0,
             reservation_listener: None,
             next_connection_attempt: now,
@@ -208,6 +222,10 @@ impl Default for CoordinationRelay {
 }
 
 impl CoordinationRelay {
+    fn is_automatic(&self) -> bool {
+        !self.automatic_addresses.is_empty()
+    }
+
     fn is_active(&self) -> bool {
         self.reserve || self.client_references > 0
     }
@@ -216,7 +234,14 @@ impl CoordinationRelay {
         self.identify_received = false;
         self.identify_sent = false;
         self.next_connection_attempt = now;
-        self.next_reservation_attempt = now + COORDINATION_RETRY_INTERVAL;
+        self.next_reservation_attempt = now
+            + if self.is_automatic() {
+                AUTOMATIC_RELAY_COOLDOWN
+            } else {
+                COORDINATION_RETRY_INTERVAL
+            };
+        self.reservation_accepted = false;
+        self.reservation_addresses.clear();
         self.reservation_listener.take()
     }
 
@@ -225,7 +250,14 @@ impl CoordinationRelay {
             return false;
         }
         self.reservation_listener = None;
-        self.next_reservation_attempt = now + COORDINATION_RETRY_INTERVAL;
+        self.reservation_accepted = false;
+        self.reservation_addresses.clear();
+        self.next_reservation_attempt = now
+            + if self.is_automatic() {
+                AUTOMATIC_RELAY_COOLDOWN
+            } else {
+                COORDINATION_RETRY_INTERVAL
+            };
         true
     }
 }
@@ -291,6 +323,8 @@ pub fn start(options: StartOptions) -> Result<StartedEndpoint, PeerError> {
     let (incoming_tx, incoming_rx) = mpsc::channel(INCOMING_STREAM_CAPACITY);
     let (mesh_incoming_tx, mesh_incoming_rx) = mpsc::channel(MESH_INCOMING_STREAM_CAPACITY);
     let (terminal_tx, terminal_rx) = mpsc::channel(1);
+    let active_coordination_relays = Arc::new(RwLock::new(Vec::new()));
+    let active_coordination_relays_for_thread = Arc::clone(&active_coordination_relays);
     let thread = thread::Builder::new()
         .name("maka-runtime-host-peer".to_owned())
         .spawn(move || {
@@ -300,6 +334,7 @@ pub fn start(options: StartOptions) -> Result<StartedEndpoint, PeerError> {
                 incoming_tx,
                 mesh_incoming_tx,
                 ready_tx.clone(),
+                active_coordination_relays_for_thread,
             );
             if let Err(error) = result {
                 let _ = ready_tx.send(Err(error.clone()));
@@ -313,6 +348,7 @@ pub fn start(options: StartOptions) -> Result<StartedEndpoint, PeerError> {
     Ok(StartedEndpoint {
         peer_id: ready.0,
         listen_addresses: ready.1,
+        active_coordination_relays,
         commands: command_tx,
         incoming: incoming_rx,
         mesh_incoming: mesh_incoming_rx,
@@ -327,6 +363,7 @@ fn run_endpoint(
     incoming_tx: mpsc::Sender<PeerStream>,
     mesh_incoming_tx: mpsc::Sender<PeerStream>,
     ready_tx: std::sync::mpsc::SyncSender<Result<(PeerId, Vec<Multiaddr>), PeerError>>,
+    active_coordination_relays: Arc<RwLock<Vec<Multiaddr>>>,
 ) -> Result<(), PeerError> {
     let runtime = tokio::runtime::Builder::new_multi_thread()
         .enable_all()
@@ -339,6 +376,7 @@ fn run_endpoint(
         incoming_tx,
         mesh_incoming_tx,
         ready_tx,
+        active_coordination_relays,
     ))
 }
 
@@ -348,6 +386,7 @@ async fn run_endpoint_async(
     incoming_tx: mpsc::Sender<PeerStream>,
     mesh_incoming_tx: mpsc::Sender<PeerStream>,
     ready_tx: std::sync::mpsc::SyncSender<Result<(PeerId, Vec<Multiaddr>), PeerError>>,
+    active_coordination_relays: Arc<RwLock<Vec<Multiaddr>>>,
 ) -> Result<(), PeerError> {
     let key = match options.expected_peer_id {
         Some(expected) => {
@@ -439,6 +478,9 @@ async fn run_endpoint_async(
     let mut external_candidate_ready = startup_external_candidate_ready;
     let mut deadline_tick = tokio::time::interval(Duration::from_millis(100));
     deadline_tick.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Skip);
+    let mut discovered_relays = options
+        .automatic_relay_discovery
+        .then(relay_discovery::spawn);
 
     loop {
         tokio::select! {
@@ -549,6 +591,34 @@ async fn run_endpoint_async(
                     // Dropping the stream applies bounded backpressure to Mesh control callers.
                 }
             }
+            Some(candidate) = async {
+                match &mut discovered_relays {
+                    Some(receiver) => receiver.recv().await,
+                    None => std::future::pending().await,
+                }
+            } => {
+                discovery_debug(format_args!("candidate {}", candidate.peer_id));
+                register_automatic_relay_candidate(
+                    &mut coordination_relays,
+                    candidate,
+                    local_peer_id,
+                );
+                rebalance_automatic_relays(
+                    &mut swarm,
+                    &mut coordination_relays,
+                    Instant::now(),
+                );
+                publish_active_coordination_relays(
+                    &coordination_relays,
+                    &active_coordination_relays,
+                );
+                maintain_coordination_relays(
+                    &mut swarm,
+                    &mut coordination_relays,
+                    external_candidate_ready,
+                    Instant::now(),
+                );
+            }
             Some(completed) = stream_completed_rx.recv() => {
                 match completed.kind {
                     StreamCompletion::Application(connection_id) => {
@@ -644,6 +714,16 @@ async fn run_endpoint_async(
                     &mut coordination_relays,
                     &mut direct,
                     &mut external_candidate_ready,
+                    &active_coordination_relays,
+                );
+                rebalance_automatic_relays(
+                    &mut swarm,
+                    &mut coordination_relays,
+                    Instant::now(),
+                );
+                publish_active_coordination_relays(
+                    &coordination_relays,
+                    &active_coordination_relays,
                 );
                 maintain_coordination_relays(
                     &mut swarm,
@@ -665,6 +745,11 @@ async fn run_endpoint_async(
             }
             _ = deadline_tick.tick() => {
                 let now = Instant::now();
+                rebalance_automatic_relays(&mut swarm, &mut coordination_relays, now);
+                publish_active_coordination_relays(
+                    &coordination_relays,
+                    &active_coordination_relays,
+                );
                 maintain_coordination_relays(
                     &mut swarm,
                     &mut coordination_relays,
@@ -883,6 +968,7 @@ fn handle_swarm_event(
     coordination_relays: &mut HashMap<PeerId, CoordinationRelay>,
     direct: &mut DirectConnectState,
     external_candidate_ready: &mut bool,
+    active_coordination_relays: &Arc<RwLock<Vec<Multiaddr>>>,
 ) {
     match event {
         SwarmEvent::ConnectionEstablished {
@@ -926,12 +1012,27 @@ fn handle_swarm_event(
             if let Some(relay) = coordination_relays.get_mut(&peer_id) {
                 relay.connections.remove(&connection_id);
             }
+            let mut reservation_changed = false;
+            let mut discard_automatic = false;
             if !swarm.is_connected(&peer_id)
                 && let Some(relay) = coordination_relays.get_mut(&peer_id)
                 && relay.is_active()
-                && let Some(listener) = relay.connection_lost(Instant::now())
             {
-                swarm.remove_listener(listener);
+                let was_accepted = relay.reservation_accepted;
+                discovery_debug(format_args!(
+                    "connection to {peer_id} closed; reservation accepted={was_accepted}"
+                ));
+                if let Some(listener) = relay.connection_lost(Instant::now()) {
+                    swarm.remove_listener(listener);
+                }
+                reservation_changed = true;
+                discard_automatic = relay.is_automatic() && !was_accepted;
+            }
+            if discard_automatic {
+                discard_automatic_relay_candidate(swarm, coordination_relays, peer_id);
+            }
+            if reservation_changed {
+                publish_active_coordination_relays(coordination_relays, active_coordination_relays);
             }
         }
         SwarmEvent::OutgoingConnectionError { connection_id, .. } => {
@@ -939,12 +1040,19 @@ fn handle_swarm_event(
             for connect in direct.pending.values_mut() {
                 connect.dials.remove(&connection_id);
             }
-            for relay in coordination_relays.values_mut() {
+            let mut failed_automatic = None;
+            for (peer_id, relay) in coordination_relays.iter_mut() {
                 if relay.pending_connection == Some(connection_id) {
                     relay.pending_connection = None;
+                    if relay.is_automatic() && !relay.reservation_accepted {
+                        failed_automatic = Some(*peer_id);
+                    }
                     break;
                 }
             }
+            if let Some(peer_id) = failed_automatic {
+                discard_automatic_relay_candidate(swarm, coordination_relays, peer_id);
+            }
         }
         SwarmEvent::Behaviour(BehaviourEvent::Dcutr(dcutr::Event {
             remote_peer_id,
@@ -958,6 +1066,40 @@ fn handle_swarm_event(
             }
         }
         SwarmEvent::Behaviour(BehaviourEvent::Dcutr(_)) => {}
+        SwarmEvent::Behaviour(BehaviourEvent::RelayClient(
+            relay::client::Event::ReservationReqAccepted { relay_peer_id, .. },
+        )) => {
+            discovery_debug(format_args!("reservation accepted by {relay_peer_id}"));
+            if let Some(relay) = coordination_relays.get_mut(&relay_peer_id) {
+                relay.reservation_accepted = true;
+            }
+            publish_active_coordination_relays(coordination_relays, active_coordination_relays);
+        }
+        SwarmEvent::NewListenAddr {
+            listener_id,
+            address,
+        } if is_relayed_address(&address) => {
+            let relay_peer = coordination_relays.iter().find_map(|(peer_id, relay)| {
+                (relay.reservation_listener == Some(listener_id)).then_some(*peer_id)
+            });
+            if let Some(relay_peer) = relay_peer {
+                let automatic = coordination_relays
+                    .get(&relay_peer)
+                    .is_some_and(CoordinationRelay::is_automatic);
+                if let Some(base_address) = reservation_base_address(address, relay_peer, automatic)
+                {
+                    if let Some(relay) = coordination_relays.get_mut(&relay_peer) {
+                        remember_reservation_address(relay, base_address);
+                    }
+                } else if automatic {
+                    if let Some(relay) = coordination_relays.get_mut(&relay_peer) {
+                        relay.reservation_accepted = false;
+                    }
+                    discard_automatic_relay_candidate(swarm, coordination_relays, relay_peer);
+                }
+                publish_active_coordination_relays(coordination_relays, active_coordination_relays);
+            }
+        }
         SwarmEvent::Behaviour(BehaviourEvent::Identify(identify::Event::Received {
             peer_id,
             ..
@@ -999,12 +1141,32 @@ fn handle_swarm_event(
                 );
             }
         }
-        SwarmEvent::ListenerClosed { listener_id, .. } => {
-            for relay in coordination_relays.values_mut() {
+        SwarmEvent::ListenerClosed {
+            listener_id,
+            reason,
+            ..
+        } => {
+            discovery_debug(format_args!(
+                "reservation listener {listener_id:?} closed: {reason:?}"
+            ));
+            let mut changed = false;
+            let mut rejected_automatic = None;
+            for (peer_id, relay) in coordination_relays.iter_mut() {
+                let was_accepted = relay.reservation_accepted;
                 if relay.listener_closed(listener_id, Instant::now()) {
+                    if relay.is_automatic() && !was_accepted {
+                        rejected_automatic = Some(*peer_id);
+                    }
+                    changed = true;
                     break;
                 }
             }
+            if let Some(peer_id) = rejected_automatic {
+                discard_automatic_relay_candidate(swarm, coordination_relays, peer_id);
+            }
+            if changed {
+                publish_active_coordination_relays(coordination_relays, active_coordination_relays);
+            }
         }
         _ => {}
     }
@@ -1023,6 +1185,7 @@ fn handle_startup_event(
         coordination_relays,
         &mut DirectConnectState::default(),
         external_candidate_ready,
+        &Arc::new(RwLock::new(Vec::new())),
     );
 }
 
@@ -1041,16 +1204,256 @@ fn register_coordination_relay(
         ));
     }
     let relay = relays.entry(relay_peer).or_default();
+    if reserve {
+        relay.automatic_addresses.clear();
+    }
     relay.reserve |= reserve;
     if add_client_reference {
         relay.client_references += 1;
     }
-    if !relay.addresses.contains(address) {
-        relay.addresses.push(address.clone());
-    }
+    remember_relay_address(&mut relay.addresses, address.clone());
     Ok(())
 }
 
+fn register_automatic_relay_candidate(
+    relays: &mut HashMap<PeerId, CoordinationRelay>,
+    candidate: relay_discovery::RelayCandidate,
+    local_peer_id: PeerId,
+) {
+    if candidate.peer_id == local_peer_id {
+        return;
+    }
+    if !relays
+        .get(&candidate.peer_id)
+        .is_some_and(CoordinationRelay::is_automatic)
+        && relays.values().filter(|relay| relay.is_automatic()).count()
+            >= MAX_AUTOMATIC_RELAY_CANDIDATES
+    {
+        return;
+    }
+    let addresses = bounded_relay_addresses(candidate.addresses);
+    if addresses.is_empty() {
+        return;
+    }
+    let relay = relays.entry(candidate.peer_id).or_default();
+    if relay.reserve && !relay.is_automatic() {
+        return;
+    }
+    relay.automatic_addresses = addresses;
+}
+
+fn rebalance_automatic_relays(
+    swarm: &mut Swarm<Behaviour>,
+    relays: &mut HashMap<PeerId, CoordinationRelay>,
+    now: Instant,
+) {
+    let manual_reservations = relays
+        .values()
+        .filter(|relay| {
+            !relay.is_automatic()
+                && relay.reservation_accepted
+                && !relay.reservation_addresses.is_empty()
+        })
+        .count();
+    let desired = TARGET_COORDINATION_RESERVATIONS.saturating_sub(manual_reservations);
+    let mut automatic = relays
+        .iter()
+        .filter(|(_, relay)| relay.is_automatic())
+        .map(|(peer_id, relay)| (*peer_id, relay.reservation_accepted, relay.reserve))
+        .collect::<Vec<_>>();
+    automatic.sort_unstable_by_key(|(peer_id, accepted, reserved)| {
+        (!*accepted, !*reserved, peer_id.to_string())
+    });
+
+    let mut selected = 0;
+    for (peer_id, accepted, _) in automatic {
+        let relay = relays
+            .get_mut(&peer_id)
+            .expect("automatic relay was collected from the same map");
+        let should_reserve = selected < desired
+            && (accepted
+                || relay.reservation_listener.is_some()
+                || relay.next_reservation_attempt <= now);
+        if should_reserve {
+            relay.reserve = true;
+            selected += 1;
+            continue;
+        }
+        relay.reserve = false;
+        relay.reservation_accepted = false;
+        relay.reservation_addresses.clear();
+        if let Some(listener) = relay.reservation_listener.take() {
+            discovery_debug(format_args!(
+                "removing reservation listener for deselected candidate {peer_id}"
+            ));
+            swarm.remove_listener(listener);
+        }
+        if relay.client_references == 0 {
+            for connection_id in relay.connections.drain() {
+                let _ = swarm.close_connection(connection_id);
+            }
+        }
+    }
+}
+
+fn publish_active_coordination_relays(
+    relays: &HashMap<PeerId, CoordinationRelay>,
+    snapshot: &Arc<RwLock<Vec<Multiaddr>>>,
+) {
+    let mut addresses = relays
+        .values()
+        .filter(|relay| relay.reservation_accepted)
+        .flat_map(|relay| relay.reservation_addresses.iter().cloned())
+        .collect::<Vec<_>>();
+    addresses.sort_unstable_by_key(ToString::to_string);
+    addresses.dedup();
+    if let Ok(mut current) = snapshot.write() {
+        *current = addresses;
+    }
+}
+
+fn bounded_relay_addresses(mut addresses: Vec<Multiaddr>) -> Vec<Multiaddr> {
+    addresses.sort_unstable_by_key(|address| (relay_route_class(address), address.to_string()));
+    let mut classes = HashSet::new();
+    addresses
+        .into_iter()
+        .filter(|address| classes.insert(relay_route_class(address)))
+        .take(MAX_RELAY_ADDRESSES_PER_PEER)
+        .collect()
+}
+
+fn relay_route_class(address: &Multiaddr) -> (u8, u8) {
+    let mut protocols = address.iter();
+    let host = match protocols.next() {
+        Some(Protocol::Ip4(_)) => 0,
+        Some(Protocol::Ip6(_)) => 1,
+        Some(Protocol::Dns(_) | Protocol::Dns4(_) | Protocol::Dns6(_)) => 2,
+        _ => 3,
+    };
+    let transport = match protocols.next() {
+        Some(Protocol::Udp(_)) => 0,
+        Some(Protocol::Tcp(_)) => 1,
+        _ => 2,
+    };
+    (host, transport)
+}
+
+fn reservation_base_address(
+    mut address: Multiaddr,
+    expected_peer: PeerId,
+    require_public: bool,
+) -> Option<Multiaddr> {
+    if !matches!(address.pop(), Some(Protocol::P2p(_)))
+        || !matches!(address.pop(), Some(Protocol::P2pCircuit))
+        || coordination_relay_peer_id(&address).ok()? != expected_peer
+        || !supported_relay_address(&address, require_public)
+    {
+        return None;
+    }
+    Some(address)
+}
+
+fn remember_reservation_address(relay: &mut CoordinationRelay, address: Multiaddr) {
+    remember_relay_address(&mut relay.reservation_addresses, address);
+}
+
+fn remember_relay_address(addresses: &mut Vec<Multiaddr>, address: Multiaddr) {
+    let class = relay_route_class(&address);
+    if let Some(existing) = addresses
+        .iter_mut()
+        .find(|existing| relay_route_class(existing) == class)
+    {
+        *existing = address;
+    } else if addresses.len() < MAX_RELAY_ADDRESSES_PER_PEER {
+        addresses.push(address);
+    }
+}
+
+fn supported_public_relay_address(address: &Multiaddr) -> bool {
+    supported_relay_address(address, true)
+}
+
+fn supported_relay_address(address: &Multiaddr, require_public: bool) -> bool {
+    let mut protocols = address.iter();
+    let host_supported = match protocols.next() {
+        Some(Protocol::Ip4(address)) => !require_public || public_ipv4(address),
+        Some(Protocol::Ip6(address)) => !require_public || public_ipv6(address),
+        Some(Protocol::Dns(_) | Protocol::Dns4(_) | Protocol::Dns6(_)) => !require_public,
+        _ => false,
+    };
+    if !host_supported {
+        return false;
+    }
+    match protocols.next() {
+        Some(Protocol::Tcp(_)) => {
+            matches!(protocols.next(), Some(Protocol::P2p(_))) && protocols.next().is_none()
+        }
+        Some(Protocol::Udp(_)) => {
+            matches!(protocols.next(), Some(Protocol::QuicV1))
+                && matches!(protocols.next(), Some(Protocol::P2p(_)))
+                && protocols.next().is_none()
+        }
+        _ => false,
+    }
+}
+
+fn public_ipv4(address: std::net::Ipv4Addr) -> bool {
+    let [first, second, third, _] = address.octets();
+    !(first == 0
+        || first == 10
+        || first == 127
+        || first >= 224
+        || (first == 100 && (64..=127).contains(&second))
+        || (first == 169 && second == 254)
+        || (first == 172 && (16..=31).contains(&second))
+        || (first == 192 && second == 0 && third == 0)
+        || (first == 192 && second == 0 && third == 2)
+        || (first == 192 && second == 168)
+        || (first == 198 && (second == 18 || second == 19))
+        || (first == 198 && second == 51 && third == 100)
+        || (first == 203 && second == 0 && third == 113))
+}
+
+fn public_ipv6(address: std::net::Ipv6Addr) -> bool {
+    if let Some(address) = address.to_ipv4() {
+        return public_ipv4(address);
+    }
+    let segments = address.segments();
+    segments[0] & 0xe000 == 0x2000
+        && !(segments[0] == 0x2001 && segments[1] < 0x0200)
+        && !(segments[0] == 0x2001 && segments[1] == 0x0db8)
+        && segments[0] != 0x2002
+        && segments[0] & 0xfff0 != 0x3ff0
+}
+
+fn discard_automatic_relay_candidate(
+    swarm: &mut Swarm<Behaviour>,
+    relays: &mut HashMap<PeerId, CoordinationRelay>,
+    peer_id: PeerId,
+) {
+    let Some(relay) = relays.get_mut(&peer_id) else {
+        return;
+    };
+    if !relay.is_automatic() || relay.reservation_accepted {
+        return;
+    }
+    relay.automatic_addresses.clear();
+    relay.reserve = false;
+    relay.reservation_addresses.clear();
+    if let Some(listener) = relay.reservation_listener.take() {
+        swarm.remove_listener(listener);
+    }
+    if relay.client_references > 0 {
+        return;
+    }
+    let mut relay = relays
+        .remove(&peer_id)
+        .expect("automatic relay candidate was read from the same map");
+    for connection_id in relay.connections.drain() {
+        let _ = swarm.close_connection(connection_id);
+    }
+}
+
 fn release_coordination_relays(
     swarm: &mut Swarm<Behaviour>,
     relays: &mut HashMap<PeerId, CoordinationRelay>,
@@ -1092,7 +1495,7 @@ fn dial_coordination_relay(
     }
     relay.next_connection_attempt = now + COORDINATION_RETRY_INTERVAL;
     let options = DialOpts::peer_id(peer_id)
-        .addresses(relay.addresses.clone())
+        .addresses(relay_dial_addresses(relay))
         .build();
     let connection_id = options.connection_id();
     if swarm.dial(options).is_ok() {
@@ -1140,14 +1543,44 @@ fn request_coordination_reservation(
         return;
     }
     relay.next_reservation_attempt = now + COORDINATION_RETRY_INTERVAL;
-    for address in &relay.addresses {
-        if let Ok(listener) = swarm.listen_on(address.clone().with(Protocol::P2pCircuit)) {
-            relay.reservation_listener = Some(listener);
-            break;
+    for address in relay_reservation_addresses(relay) {
+        match swarm.listen_on(address.with(Protocol::P2pCircuit)) {
+            Ok(listener) => {
+                discovery_debug(format_args!("requesting reservation from {peer_id}"));
+                relay.reservation_listener = Some(listener);
+                break;
+            }
+            Err(error) => {
+                discovery_debug(format_args!(
+                    "reservation request for {peer_id} failed: {error}"
+                ));
+            }
         }
     }
 }
 
+fn relay_dial_addresses(relay: &CoordinationRelay) -> Vec<Multiaddr> {
+    let mut addresses = relay.addresses.clone();
+    addresses.extend(relay.automatic_addresses.iter().cloned());
+    addresses.sort_unstable_by_key(ToString::to_string);
+    addresses.dedup();
+    addresses
+}
+
+fn relay_reservation_addresses(relay: &CoordinationRelay) -> Vec<Multiaddr> {
+    if relay.is_automatic() {
+        relay.automatic_addresses.clone()
+    } else {
+        relay.addresses.clone()
+    }
+}
+
+fn discovery_debug(message: std::fmt::Arguments<'_>) {
+    if std::env::var_os("MAKA_PEER_DISCOVERY_DEBUG").is_some() {
+        eprintln!("[peer-relay-pool] {message}");
+    }
+}
+
 fn retry_connect_routes(
     swarm: &mut Swarm<Behaviour>,
     direct: &mut DirectConnectState,
@@ -1366,6 +1799,7 @@ mod tests {
                     .expect("test listen address"),
             ],
             coordination_relays: Vec::new(),
+            automatic_relay_discovery: false,
         }
     }
 
@@ -1448,6 +1882,12 @@ mod tests {
         let mut relay = CoordinationRelay {
             identify_received: true,
             identify_sent: true,
+            reservation_accepted: true,
+            reservation_addresses: vec![
+                "/ip4/192.0.2.1/tcp/4001"
+                    .parse()
+                    .expect("valid reservation address"),
+            ],
             reservation_listener: Some(listener),
             next_connection_attempt: now + Duration::from_secs(30),
             next_reservation_attempt: now + Duration::from_secs(30),
@@ -1456,6 +1896,8 @@ mod tests {
 
         assert!(relay.listener_closed(listener, now));
         assert!(relay.reservation_listener.is_none());
+        assert!(!relay.reservation_accepted);
+        assert!(relay.reservation_addresses.is_empty());
 
         relay.reservation_listener = Some(listener);
         assert_eq!(relay.connection_lost(now), Some(listener));
@@ -1464,6 +1906,43 @@ mod tests {
         assert_eq!(relay.next_connection_attempt, now);
     }
 
+    #[test]
+    fn active_coordination_routes_only_publish_accepted_reservations() {
+        let accepted_peer = PeerId::random();
+        let pending_peer = PeerId::random();
+        let accepted_address: Multiaddr = format!("/ip4/192.0.2.1/tcp/4001/p2p/{accepted_peer}")
+            .parse()
+            .expect("valid accepted relay address");
+        let pending_address: Multiaddr = format!("/ip4/192.0.2.2/tcp/4001/p2p/{pending_peer}")
+            .parse()
+            .expect("valid pending relay address");
+        let relays = HashMap::from([
+            (
+                accepted_peer,
+                CoordinationRelay {
+                    reservation_accepted: true,
+                    reservation_addresses: vec![accepted_address.clone()],
+                    ..CoordinationRelay::default()
+                },
+            ),
+            (
+                pending_peer,
+                CoordinationRelay {
+                    reservation_addresses: vec![pending_address],
+                    ..CoordinationRelay::default()
+                },
+            ),
+        ]);
+        let snapshot = Arc::new(RwLock::new(Vec::new()));
+
+        publish_active_coordination_relays(&relays, &snapshot);
+
+        assert_eq!(
+            *snapshot.read().expect("read snapshot"),
+            vec![accepted_address]
+        );
+    }
+
     #[test]
     fn coordination_relay_requires_one_terminal_peer_identity() {
         let relay = PeerId::random();
@@ -1481,4 +1960,147 @@ mod tests {
             .expect("valid relayed address");
         assert!(coordination_relay_peer_id(&tunneled).is_err());
     }
+
+    #[test]
+    fn relay_routes_enforce_origin_policy_identity_and_replacement() {
+        let relay = PeerId::random();
+        let local = PeerId::random();
+        let other = PeerId::random();
+        let public_quic: Multiaddr = format!("/ip4/1.1.1.1/udp/4001/quic-v1/p2p/{relay}")
+            .parse()
+            .expect("valid public QUIC address");
+        let private_tcp: Multiaddr = format!("/ip4/192.168.1.2/tcp/4001/p2p/{relay}")
+            .parse()
+            .expect("valid private TCP address");
+        let unsupported_websocket: Multiaddr = format!("/ip4/1.1.1.1/tcp/4001/ws/p2p/{relay}")
+            .parse()
+            .expect("valid WebSocket address");
+        let mapped_private: Multiaddr = format!("/ip6/::ffff:127.0.0.1/tcp/4001/p2p/{relay}")
+            .parse()
+            .expect("valid IPv4-mapped private address");
+        let compatible_private: Multiaddr = format!("/ip6/::127.0.0.1/tcp/4001/p2p/{relay}")
+            .parse()
+            .expect("valid IPv4-compatible private address");
+        let former_site_local: Multiaddr = format!("/ip6/fec0::1/tcp/4001/p2p/{relay}")
+            .parse()
+            .expect("valid former site-local address");
+
+        assert!(supported_public_relay_address(&public_quic));
+        assert!(!supported_public_relay_address(&private_tcp));
+        assert!(!supported_public_relay_address(&unsupported_websocket));
+        assert!(!supported_public_relay_address(&mapped_private));
+        assert!(!supported_public_relay_address(&compatible_private));
+        assert!(!supported_public_relay_address(&former_site_local));
+
+        let manual_route: Multiaddr = format!("{private_tcp}/p2p-circuit/p2p/{local}")
+            .parse()
+            .expect("valid manual reservation route");
+        assert_eq!(
+            reservation_base_address(manual_route.clone(), relay, false),
+            Some(private_tcp),
+        );
+        assert!(reservation_base_address(manual_route, other, false).is_none());
+
+        let dns_base: Multiaddr = format!("/dns4/relay.example/tcp/4001/p2p/{relay}")
+            .parse()
+            .expect("valid DNS relay address");
+        let dns_route: Multiaddr = format!("{dns_base}/p2p-circuit/p2p/{local}")
+            .parse()
+            .expect("valid DNS reservation route");
+        assert!(reservation_base_address(dns_route.clone(), relay, true).is_none());
+        assert_eq!(
+            reservation_base_address(dns_route, relay, false),
+            Some(dns_base),
+        );
+
+        let mut state = CoordinationRelay::default();
+        let first: Multiaddr = format!("/ip4/1.1.1.1/tcp/4001/p2p/{relay}")
+            .parse()
+            .expect("valid first relay route");
+        let renewed: Multiaddr = format!("/ip4/1.0.0.1/tcp/4001/p2p/{relay}")
+            .parse()
+            .expect("valid renewed relay route");
+        remember_reservation_address(&mut state, first);
+        remember_reservation_address(&mut state, renewed.clone());
+        assert_eq!(state.reservation_addresses, vec![renewed]);
+
+        let automatic_peer = PeerId::random();
+        let automatic_address: Multiaddr = format!("/ip4/1.1.1.1/tcp/4001/p2p/{automatic_peer}")
+            .parse()
+            .expect("valid automatic relay address");
+        let replacement: Multiaddr = format!("/ip4/8.8.8.8/tcp/4001/p2p/{automatic_peer}")
+            .parse()
+            .expect("valid replacement relay address");
+        let mut relays = HashMap::new();
+        register_automatic_relay_candidate(
+            &mut relays,
+            relay_discovery::RelayCandidate {
+                peer_id: automatic_peer,
+                addresses: vec![automatic_address],
+            },
+            local,
+        );
+        register_automatic_relay_candidate(
+            &mut relays,
+            relay_discovery::RelayCandidate {
+                peer_id: automatic_peer,
+                addresses: vec![replacement.clone()],
+            },
+            local,
+        );
+        let automatic = relays
+            .get_mut(&automatic_peer)
+            .expect("automatic relay is registered");
+        let private_client_address: Multiaddr =
+            format!("/ip4/192.168.1.20/tcp/4001/p2p/{automatic_peer}")
+                .parse()
+                .expect("valid private client relay address");
+        automatic.addresses.push(private_client_address);
+        assert_eq!(relay_reservation_addresses(automatic), vec![replacement]);
+
+        let mut bounded = HashMap::new();
+        for _ in 0..MAX_AUTOMATIC_RELAY_CANDIDATES {
+            let peer = PeerId::random();
+            let address = format!("/ip4/1.1.1.1/tcp/4001/p2p/{peer}")
+                .parse()
+                .expect("valid bounded relay address");
+            bounded.insert(
+                peer,
+                CoordinationRelay {
+                    automatic_addresses: vec![address],
+                    ..CoordinationRelay::default()
+                },
+            );
+        }
+        let client_peer = PeerId::random();
+        let client_address = format!("/ip4/1.1.1.1/tcp/4001/p2p/{client_peer}")
+            .parse()
+            .expect("valid client relay address");
+        register_coordination_relay(&mut bounded, &client_address, local, false, true)
+            .expect("client relay is registered");
+        let replacement_client_address = format!("/ip4/8.8.8.8/tcp/4001/p2p/{client_peer}")
+            .parse()
+            .expect("valid replacement client relay address");
+        register_coordination_relay(
+            &mut bounded,
+            &replacement_client_address,
+            local,
+            false,
+            false,
+        )
+        .expect("client relay address is refreshed");
+        assert_eq!(
+            bounded[&client_peer].addresses,
+            vec![replacement_client_address]
+        );
+        register_automatic_relay_candidate(
+            &mut bounded,
+            relay_discovery::RelayCandidate {
+                peer_id: client_peer,
+                addresses: vec![client_address],
+            },
+            local,
+        );
+        assert!(!bounded[&client_peer].is_automatic());
+    }
 }
diff --git a/native/runtime-host-peer/src/engine/relay_discovery.rs b/native/runtime-host-peer/src/engine/relay_discovery.rs
new file mode 100644
index 0000000000..e7bec1ffd4
--- /dev/null
+++ b/native/runtime-host-peer/src/engine/relay_discovery.rs
@@ -0,0 +1,504 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+use std::{
+    collections::{HashMap, HashSet, VecDeque, hash_map::Entry},
+    ops::{Deref, DerefMut},
+    task::{Context, Poll},
+    time::{Duration, Instant},
+};
+
+use futures::StreamExt;
+use libp2p::{
+    Multiaddr, PeerId, StreamProtocol, Swarm, SwarmBuilder, connection_limits,
+    core::{Endpoint, transport::PortUse},
+    identify, identity,
+    kad::{self, store::MemoryStore},
+    noise, ping,
+    swarm::{
+        ConnectionDenied, ConnectionId, FromSwarm, NetworkBehaviour, SwarmEvent, THandler,
+        THandlerInEvent, THandlerOutEvent, ToSwarm, dial_opts::DialOpts,
+    },
+    tcp, yamux,
+};
+use tokio::sync::mpsc;
+
+use super::{address::address_with_peer, supported_public_relay_address};
+
+const AMINO_PROTOCOL: &str = "/ipfs/kad/1.0.0";
+const IDENTIFY_PROTOCOL: &str = "/maka/runtime-host/relay-discovery/1";
+const RELAY_HOP_PROTOCOL: &str = "/libp2p/circuit/relay/0.2.0/hop";
+const DISCOVERY_INTERVAL: Duration = Duration::from_secs(30);
+const IDLE_CONNECTION_TIMEOUT: Duration = Duration::from_secs(10);
+const MAX_PENDING_PROBES: usize = 8;
+const MAX_KNOWN_PEERS: usize = 256;
+const MAX_ADDRESSES_PER_PEER: usize = 8;
+const PROBE_REVISIT_INTERVAL: Duration = Duration::from_secs(10 * 60);
+
+const AMINO_BOOTSTRAPS: &[&str] = &[
+    "/dnsaddr/bootstrap.libp2p.io/p2p/QmNnooDu7bfjPFoTZYxMNLWUQJyrVwtbZg5gBMjTezGAJN",
+    "/dnsaddr/bootstrap.libp2p.io/p2p/QmQCU2EcMqAqQPR2i9bChDtGNJchTbq5TbXJJ16u19uLTa",
+    "/dnsaddr/bootstrap.libp2p.io/p2p/QmbLHAnMoJPWSCR5Zhtx6BHJX9KiKNN6tpvbUcqanj75Nb",
+    "/dnsaddr/bootstrap.libp2p.io/p2p/QmcZf59bWwK5XFi76CZX8cbJ4BhTzzA3gU1ZjYZcYW3dwt",
+    "/dnsaddr/va1.bootstrap.libp2p.io/p2p/12D3KooWKnDdG3iXw9eTFijk3EWSunZcFi54Zka4wmtqtt6rPxc8",
+    "/ip4/104.131.131.82/tcp/4001/p2p/QmaCpDMGvV2BGHeYERUEnRQAwe3N8SzbUtfsmvsqQLuvuJ",
+    "/ip4/104.131.131.82/udp/4001/quic-v1/p2p/QmaCpDMGvV2BGHeYERUEnRQAwe3N8SzbUtfsmvsqQLuvuJ",
+];
+
+struct KnownPeer {
+    addresses: Vec<Multiaddr>,
+    first_seen: Instant,
+}
+
+#[derive(Debug)]
+pub(super) struct RelayCandidate {
+    pub peer_id: PeerId,
+    pub addresses: Vec<Multiaddr>,
+}
+
+#[derive(NetworkBehaviour)]
+struct Behaviour {
+    connection_limits: connection_limits::Behaviour,
+    kad: PublicKad,
+    identify: identify::Behaviour,
+    ping: ping::Behaviour,
+}
+
+struct PublicKad(kad::Behaviour<MemoryStore>);
+
+impl Deref for PublicKad {
+    type Target = kad::Behaviour<MemoryStore>;
+
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+impl DerefMut for PublicKad {
+    fn deref_mut(&mut self) -> &mut Self::Target {
+        &mut self.0
+    }
+}
+
+impl NetworkBehaviour for PublicKad {
+    type ConnectionHandler = <kad::Behaviour<MemoryStore> as NetworkBehaviour>::ConnectionHandler;
+    type ToSwarm = <kad::Behaviour<MemoryStore> as NetworkBehaviour>::ToSwarm;
+
+    fn handle_pending_inbound_connection(
+        &mut self,
+        connection_id: ConnectionId,
+        local_addr: &Multiaddr,
+        remote_addr: &Multiaddr,
+    ) -> Result<(), ConnectionDenied> {
+        self.0
+            .handle_pending_inbound_connection(connection_id, local_addr, remote_addr)
+    }
+
+    fn handle_established_inbound_connection(
+        &mut self,
+        connection_id: ConnectionId,
+        peer: PeerId,
+        local_addr: &Multiaddr,
+        remote_addr: &Multiaddr,
+    ) -> Result<THandler<Self>, ConnectionDenied> {
+        self.0
+            .handle_established_inbound_connection(connection_id, peer, local_addr, remote_addr)
+    }
+
+    fn handle_pending_outbound_connection(
+        &mut self,
+        connection_id: ConnectionId,
+        maybe_peer: Option<PeerId>,
+        addresses: &[Multiaddr],
+        effective_role: Endpoint,
+    ) -> Result<Vec<Multiaddr>, ConnectionDenied> {
+        let addresses = self.0.handle_pending_outbound_connection(
+            connection_id,
+            maybe_peer,
+            addresses,
+            effective_role,
+        )?;
+        Ok(addresses
+            .into_iter()
+            .filter(|address| allowed_kad_dial_address(maybe_peer, address))
+            .collect())
+    }
+
+    fn handle_established_outbound_connection(
+        &mut self,
+        connection_id: ConnectionId,
+        peer: PeerId,
+        address: &Multiaddr,
+        role_override: Endpoint,
+        port_use: PortUse,
+    ) -> Result<THandler<Self>, ConnectionDenied> {
+        self.0.handle_established_outbound_connection(
+            connection_id,
+            peer,
+            address,
+            role_override,
+            port_use,
+        )
+    }
+
+    fn on_swarm_event(&mut self, event: FromSwarm) {
+        self.0.on_swarm_event(event);
+    }
+
+    fn on_connection_handler_event(
+        &mut self,
+        peer_id: PeerId,
+        connection_id: ConnectionId,
+        event: THandlerOutEvent<Self>,
+    ) {
+        self.0
+            .on_connection_handler_event(peer_id, connection_id, event);
+    }
+
+    fn poll(
+        &mut self,
+        cx: &mut Context<'_>,
+    ) -> Poll<ToSwarm<Self::ToSwarm, THandlerInEvent<Self>>> {
+        self.0.poll(cx)
+    }
+}
+
+pub(super) fn spawn() -> mpsc::Receiver<RelayCandidate> {
+    let (sender, receiver) = mpsc::channel(32);
+    tokio::spawn(async move {
+        match build_swarm() {
+            Ok(mut swarm) => run(&mut swarm, sender).await,
+            Err(error) => eprintln!("[peer-relay-discovery] unavailable: {error}"),
+        }
+    });
+    receiver
+}
+
+fn build_swarm() -> Result<Swarm<Behaviour>, Box<dyn std::error::Error + Send + Sync>> {
+    let key = identity::Keypair::generate_ed25519();
+    let local_peer_id = key.public().to_peer_id();
+    let swarm = SwarmBuilder::with_existing_identity(key)
+        .with_tokio()
+        .with_tcp(
+            tcp::Config::default().nodelay(true),
+            noise::Config::new,
+            yamux::Config::default,
+        )?
+        .with_quic()
+        .with_dns()?
+        .with_behaviour(move |key| {
+            let mut config = kad::Config::new(StreamProtocol::new(AMINO_PROTOCOL));
+            config.set_query_timeout(Duration::from_secs(15));
+            let mut kad =
+                kad::Behaviour::with_config(local_peer_id, MemoryStore::new(local_peer_id), config);
+            kad.set_mode(Some(kad::Mode::Client));
+            Behaviour {
+                connection_limits: connection_limits::Behaviour::new(
+                    connection_limits::ConnectionLimits::default()
+                        .with_max_pending_outgoing(Some(MAX_PENDING_PROBES as u32))
+                        .with_max_established_outgoing(Some(32))
+                        .with_max_established(Some(32))
+                        .with_max_established_per_peer(Some(1)),
+                ),
+                kad: PublicKad(kad),
+                identify: identify::Behaviour::new(discovery_identify_config(key.public())),
+                ping: ping::Behaviour::new(ping::Config::new()),
+            }
+        })?
+        .with_swarm_config(|config| config.with_idle_connection_timeout(IDLE_CONNECTION_TIMEOUT))
+        .build();
+    Ok(swarm)
+}
+
+fn discovery_identify_config(public_key: identity::PublicKey) -> identify::Config {
+    identify::Config::new(IDENTIFY_PROTOCOL.to_owned(), public_key).with_cache_size(0)
+}
+
+async fn run(swarm: &mut Swarm<Behaviour>, sender: mpsc::Sender<RelayCandidate>) {
+    let mut known = HashMap::<PeerId, KnownPeer>::new();
+    let mut pending = HashSet::<PeerId>::new();
+    let mut queue = VecDeque::<PeerId>::new();
+
+    for value in AMINO_BOOTSTRAPS {
+        let Ok(address) = value.parse::<Multiaddr>() else {
+            continue;
+        };
+        let Some(peer_id) = terminal_peer_id(&address) else {
+            continue;
+        };
+        remember_canonical(
+            peer_id,
+            vec![address_with_peer(address, peer_id)],
+            &mut known,
+            &mut queue,
+            Instant::now(),
+        );
+        for address in known
+            .get(&peer_id)
+            .into_iter()
+            .flat_map(|peer| &peer.addresses)
+        {
+            swarm
+                .behaviour_mut()
+                .kad
+                .add_address(&peer_id, address.clone());
+        }
+    }
+    let _ = swarm.behaviour_mut().kad.bootstrap();
+
+    let mut walk = tokio::time::interval(DISCOVERY_INTERVAL);
+    walk.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Skip);
+    loop {
+        start_probes(swarm, &known, &mut queue, &mut pending);
+        tokio::select! {
+            _ = walk.tick() => {
+                expire_known_peers(&mut known, &pending, Instant::now());
+                swarm.behaviour_mut().kad.get_closest_peers(PeerId::random().to_bytes());
+            }
+            event = swarm.select_next_some() => match event {
+                SwarmEvent::Behaviour(BehaviourEvent::Kad(kad::Event::OutboundQueryProgressed {
+                    result: kad::QueryResult::GetClosestPeers(result),
+                    ..
+                })) => {
+                    let peers = match result {
+                        Ok(result) => result.peers,
+                        Err(kad::GetClosestPeersError::Timeout { peers, .. }) => peers,
+                    };
+                    debug(format_args!("DHT walk returned {} peers", peers.len()));
+                    for peer in peers {
+                        remember(
+                            peer.peer_id,
+                            peer.addrs,
+                            &mut known,
+                            &mut queue,
+                            Instant::now(),
+                        );
+                    }
+                }
+                SwarmEvent::Behaviour(BehaviourEvent::Kad(kad::Event::RoutingUpdated {
+                    peer,
+                    addresses: discovered,
+                    ..
+                })) => {
+                    remember(
+                        peer,
+                        discovered.into_vec(),
+                        &mut known,
+                        &mut queue,
+                        Instant::now(),
+                    );
+                }
+                SwarmEvent::Behaviour(BehaviourEvent::Identify(identify::Event::Received {
+                    peer_id,
+                    info,
+                    ..
+                })) => {
+                    pending.remove(&peer_id);
+                    let mut candidate_addresses = info.listen_addrs;
+                    if let Some(discovered) = known.get(&peer_id) {
+                        candidate_addresses.extend(discovered.addresses.iter().cloned());
+                    }
+                    candidate_addresses = canonical_addresses(peer_id, candidate_addresses);
+                    debug(format_args!(
+                        "identified {peer_id}; relay={} addresses={}",
+                        info.protocols.iter().any(|protocol| protocol.as_ref() == RELAY_HOP_PROTOCOL),
+                        candidate_addresses.len(),
+                    ));
+                    if info.protocols.iter().any(|protocol| protocol.as_ref() == RELAY_HOP_PROTOCOL)
+                        && !candidate_addresses.is_empty()
+                        && sender.send(RelayCandidate {
+                            peer_id,
+                            addresses: candidate_addresses,
+                        }).await.is_err()
+                    {
+                        return;
+                    }
+                }
+                SwarmEvent::OutgoingConnectionError { peer_id: Some(peer_id), error, .. } => {
+                    debug(format_args!("dial to {peer_id} failed: {error}"));
+                    pending.remove(&peer_id);
+                }
+                SwarmEvent::ConnectionClosed { peer_id, .. } => {
+                    pending.remove(&peer_id);
+                }
+                _ => {}
+            }
+        }
+    }
+}
+
+fn debug(message: std::fmt::Arguments<'_>) {
+    if std::env::var_os("MAKA_PEER_DISCOVERY_DEBUG").is_some() {
+        eprintln!("[peer-relay-discovery] {message}");
+    }
+}
+
+fn remember(
+    peer_id: PeerId,
+    discovered: Vec<Multiaddr>,
+    known: &mut HashMap<PeerId, KnownPeer>,
+    queue: &mut VecDeque<PeerId>,
+    now: Instant,
+) {
+    let discovered = canonical_addresses(peer_id, discovered);
+    remember_canonical(peer_id, discovered, known, queue, now);
+}
+
+fn remember_canonical(
+    peer_id: PeerId,
+    mut discovered: Vec<Multiaddr>,
+    known: &mut HashMap<PeerId, KnownPeer>,
+    queue: &mut VecDeque<PeerId>,
+    now: Instant,
+) {
+    discovered.truncate(MAX_ADDRESSES_PER_PEER);
+    if discovered.is_empty() || !known.contains_key(&peer_id) && known.len() >= MAX_KNOWN_PEERS {
+        return;
+    }
+    match known.entry(peer_id) {
+        Entry::Occupied(mut entry) => {
+            for address in discovered {
+                if entry.get().addresses.len() >= MAX_ADDRESSES_PER_PEER {
+                    break;
+                }
+                if !entry.get().addresses.contains(&address) {
+                    entry.get_mut().addresses.push(address);
+                }
+            }
+        }
+        Entry::Vacant(entry) => {
+            entry.insert(KnownPeer {
+                addresses: discovered,
+                first_seen: now,
+            });
+            queue.push_back(peer_id);
+        }
+    }
+}
+
+fn expire_known_peers(
+    known: &mut HashMap<PeerId, KnownPeer>,
+    pending: &HashSet<PeerId>,
+    now: Instant,
+) {
+    known.retain(|peer_id, peer| {
+        pending.contains(peer_id) || now.duration_since(peer.first_seen) < PROBE_REVISIT_INTERVAL
+    });
+}
+
+fn start_probes(
+    swarm: &mut Swarm<Behaviour>,
+    known: &HashMap<PeerId, KnownPeer>,
+    queue: &mut VecDeque<PeerId>,
+    pending: &mut HashSet<PeerId>,
+) {
+    while pending.len() < MAX_PENDING_PROBES {
+        let Some(peer_id) = queue.pop_front() else {
+            break;
+        };
+        let Some(peer) = known.get(&peer_id) else {
+            continue;
+        };
+        let options = DialOpts::peer_id(peer_id)
+            .addresses(peer.addresses.clone())
+            .build();
+        if swarm.dial(options).is_ok() {
+            pending.insert(peer_id);
+        }
+    }
+}
+
+fn canonical_addresses(peer_id: PeerId, addresses: Vec<Multiaddr>) -> Vec<Multiaddr> {
+    let mut result = Vec::new();
+    for address in addresses {
+        if address
+            .iter()
+            .any(|protocol| matches!(protocol, libp2p::multiaddr::Protocol::P2pCircuit))
+        {
+            continue;
+        }
+        let address = address_with_peer(address, peer_id);
+        if has_literal_ip_host(&address)
+            && supported_public_relay_address(&address)
+            && !result.contains(&address)
+        {
+            result.push(address);
+        }
+    }
+    result
+}
+
+fn allowed_kad_dial_address(peer_id: Option<PeerId>, address: &Multiaddr) -> bool {
+    let Some(peer_id) = peer_id else {
+        return false;
+    };
+    let canonical = address_with_peer(address.clone(), peer_id);
+    if supported_public_relay_address(&canonical) {
+        return true;
+    }
+    AMINO_BOOTSTRAPS.iter().any(|value| {
+        value
+            .parse::<Multiaddr>()
+            .is_ok_and(|bootstrap| bootstrap == canonical)
+    })
+}
+
+fn terminal_peer_id(address: &Multiaddr) -> Option<PeerId> {
+    match address.iter().last()? {
+        libp2p::multiaddr::Protocol::P2p(peer_id) => Some(peer_id),
+        _ => None,
+    }
+}
+
+fn has_literal_ip_host(address: &Multiaddr) -> bool {
+    matches!(
+        address.iter().next(),
+        Some(libp2p::multiaddr::Protocol::Ip4(_) | libp2p::multiaddr::Protocol::Ip6(_))
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn kad_dials_only_public_addresses_or_exact_bootstraps() {
+        let peer = PeerId::random();
+        let public: Multiaddr = "/ip4/1.1.1.1/tcp/4001".parse().expect("public address");
+        let private: Multiaddr = "/ip4/127.0.0.1/tcp/4001".parse().expect("private address");
+        let dns: Multiaddr = "/dns4/attacker.example/tcp/4001"
+            .parse()
+            .expect("DNS address");
+
+        assert!(allowed_kad_dial_address(Some(peer), &public));
+        assert!(!allowed_kad_dial_address(Some(peer), &private));
+        assert!(!allowed_kad_dial_address(Some(peer), &dns));
+
+        let bootstrap: Multiaddr = AMINO_BOOTSTRAPS[0]
+            .parse()
+            .expect("constant bootstrap address");
+        let bootstrap_peer = terminal_peer_id(&bootstrap).expect("bootstrap peer identity");
+        assert!(allowed_kad_dial_address(Some(bootstrap_peer), &bootstrap,));
+        assert!(!allowed_kad_dial_address(Some(peer), &bootstrap));
+        assert_eq!(
+            discovery_identify_config(identity::Keypair::generate_ed25519().public()).cache_size(),
+            0,
+        );
+    }
+}
diff --git a/packages/cli/RUNTIME_HOST_PEER_DEPENDENCIES.rust.tsv b/packages/cli/RUNTIME_HOST_PEER_DEPENDENCIES.rust.tsv
index b5b200eead..16be61345c 100644
--- a/packages/cli/RUNTIME_HOST_PEER_DEPENDENCIES.rust.tsv
+++ b/packages/cli/RUNTIME_HOST_PEER_DEPENDENCIES.rust.tsv
@@ -4,6 +4,7 @@ arrayref@0.3.9		X
 asn1-rs@0.7.2	X				X			
 asn1-rs-derive@0.6.0	X				X			
 asn1-rs-impl@0.2.0	X				X			
+asn1_der@0.7.7		X			X			
 async-trait@0.1.92	X				X			
 asynchronous-codec@0.7.0					X			
 autocfg@1.5.1	X				X			
@@ -30,6 +31,7 @@ critical-section@1.2.0	X				X
 crossbeam-channel@0.5.16	X				X			
 crossbeam-epoch@0.9.20	X				X			
 crossbeam-utils@0.8.22	X				X			
+crunchy@0.2.4					X			
 crypto-common@0.1.7	X				X			
 ctor@1.0.13	X				X			
 curve25519-dalek@4.1.3			X					
@@ -71,6 +73,7 @@ getrandom@0.4.3	X				X
 hashbrown@0.15.5	X				X			
 hashlink@0.10.0	X				X			
 heck@0.5.0	X				X			
+hex@0.4.3	X				X			
 hickory-proto@0.25.2	X				X			
 hickory-resolver@0.25.2	X				X			
 hkdf@0.12.4	X				X			
@@ -101,6 +104,7 @@ libp2p-dcutr@0.14.1					X
 libp2p-dns@0.44.0					X			
 libp2p-identify@0.47.0					X			
 libp2p-identity@0.2.14					X			
+libp2p-kad@0.48.0					X			
 libp2p-noise@0.46.1					X			
 libp2p-ping@0.47.0					X			
 libp2p-quic@0.13.1					X			
@@ -221,6 +225,7 @@ tracing@0.1.44					X
 tracing-attributes@0.1.31					X			
 tracing-core@0.1.36					X			
 typenum@1.20.1	X				X			
+uint@0.10.1	X				X			
 unicode-ident@1.0.24	X				X	X		
 unicode-segmentation@1.13.3	X				X			
 unsigned-varint@0.7.2					X			
diff --git a/packages/cli/RUNTIME_HOST_PEER_THIRD_PARTY_NOTICES.txt b/packages/cli/RUNTIME_HOST_PEER_THIRD_PARTY_NOTICES.txt
index b6cab8d19d..3af1c6add8 100644
--- a/packages/cli/RUNTIME_HOST_PEER_THIRD_PARTY_NOTICES.txt
+++ b/packages/cli/RUNTIME_HOST_PEER_THIRD_PARTY_NOTICES.txt
@@ -5,8 +5,8 @@ Generated by scripts/generate-runtime-host-peer-notices.mjs from the exact
 four-target production dependency inventory. Do not edit this file by hand.
 
 Manifest: native/runtime-host-peer/Cargo.toml
-Cargo.lock SHA-256: 07524c9f4eac723344e6fd8746a2f7cfed692feaed1785ecbfd45e0ecbe20981
-Inventory SHA-256: eb4b2941cf0ed87153aff3ac5d32697dde3ba105e388ff96b9584c65882834f1
+Cargo.lock SHA-256: f475d62519bef1d83c2e33b17f1b1eeffe7a03370b041dabea887b7f57aa43ff
+Inventory SHA-256: 4078d1a287187fbfe21e4937305dabf6e81afac6f2f45388b47a04f311cd8223
 
 Packages
 --------
@@ -44,6 +44,12 @@ SPDX license: MIT/Apache-2.0
 Source: https://github.com/rusticata/asn1-rs.git
 License text: 59013a5c8d3a19c26a457579105915a5d51bb0c09d579f8cdedf12e4203c3018 (Apache-2.0.txt)
 
+asn1_der@0.7.7
+--------------
+SPDX license: BSD-2-Clause OR MIT
+Source: https://github.com/KizzyCode/asn1_der-rust
+License text: b70b1cc58b6d09afc7bfba35c45cc8613d121563acc5b9cbc519ae3b9a10af8d (MIT.txt)
+
 async-trait@0.1.92
 ------------------
 SPDX license: MIT OR Apache-2.0
@@ -219,6 +225,12 @@ Source: https://github.com/crossbeam-rs/crossbeam
 License text: 769f80b5bcb42ed0af4e4d2fd74e1ac9bf843cb80c5a29219d1ef3544428a6bb (LICENSE-APACHE)
 License text: 5a7d13c6710cdec29e74eb3172b80712049c34099ab7259661ada051fc90777b (LICENSE-MIT)
 
+crunchy@0.2.4
+-------------
+SPDX license: MIT
+Source: https://github.com/eira-fransham/crunchy
+License text: e35e8f8a37b546c01c7eb82d11d7554bb6292a29fc6147c21765d1e9c40b2bae (LICENSE)
+
 crypto-common@0.1.7
 -------------------
 SPDX license: MIT OR Apache-2.0
@@ -497,6 +509,13 @@ Source: https://github.com/withoutboats/heck
 License text: 769f80b5bcb42ed0af4e4d2fd74e1ac9bf843cb80c5a29219d1ef3544428a6bb (LICENSE-APACHE)
 License text: 033a9383ff21d1e4811d98dd2e0081b0ba0d9c9a31d6c7ba9e63e3488479bf29 (LICENSE-MIT)
 
+hex@0.4.3
+---------
+SPDX license: MIT OR Apache-2.0
+Source: https://github.com/KokaKiwi/rust-hex
+License text: c5accbbd8546e94c34aed24afe689a617627d18eed5a6c48277e48db57c23851 (LICENSE-APACHE)
+License text: 9dde4a6ad496606322ae0b61b70dc7123fa231be543caa0896d567e34d20fbf8 (LICENSE-MIT)
+
 hickory-proto@0.25.2
 --------------------
 SPDX license: MIT OR Apache-2.0
@@ -689,6 +708,12 @@ SPDX license: MIT
 Source: https://github.com/libp2p/rust-libp2p
 License text: 80f847ab8b3d1802dcf33aad57b13d3e5cbae4969fb5990a5ff24ac7ae98ddb6 (MIT.txt)
 
+libp2p-kad@0.48.0
+-----------------
+SPDX license: MIT
+Source: https://github.com/libp2p/rust-libp2p
+License text: 4104e268c110e0948f82580e90eeb8a4106c388c4c0f6a1b7ed2e4dd1360872a (MIT.txt)
+
 libp2p-noise@0.46.1
 -------------------
 SPDX license: MIT
@@ -1483,6 +1508,12 @@ License text: db11fec9946737df39ca3898d9cd8c10ec6f6c3a884a6802b0ad0b81b4e8f23a (
 License text: 516b24e051bf5630880ebbd55c40a25ce9552ebaf8970a53e8976eb70e522406 (LICENSE-APACHE)
 License text: 87ebb37988efc3285a41635c6a9fd38147e1e581b5f0556a284d5ab8fa5cdd4c (LICENSE-MIT)
 
+uint@0.10.1
+-----------
+SPDX license: MIT OR Apache-2.0
+Source: https://github.com/paritytech/parity-common
+License text: 59013a5c8d3a19c26a457579105915a5d51bb0c09d579f8cdedf12e4203c3018 (Apache-2.0.txt)
+
 unicode-ident@1.0.24
 --------------------
 SPDX license: (MIT OR Apache-2.0) AND Unicode-3.0
@@ -3831,6 +3862,7 @@ Used by:
 - libp2p-core@0.43.2 (MIT.txt)
 - libp2p-dns@0.44.0 (MIT.txt)
 - libp2p-identify@0.47.0 (MIT.txt)
+- libp2p-kad@0.48.0 (MIT.txt)
 - libp2p-noise@0.46.1 (MIT.txt)
 - libp2p-ping@0.47.0 (MIT.txt)
 - libp2p-quic@0.13.1 (MIT.txt)
@@ -5215,6 +5247,7 @@ Used by:
 - if-watch@3.2.2 (Apache-2.0.txt)
 - sha2@0.10.9 (LICENSE-APACHE)
 - signature@2.2.0 (LICENSE-APACHE)
+- uint@0.10.1 (Apache-2.0.txt)
 - yamux@0.12.1 (Apache-2.0.txt)
 - yamux@0.13.10 (Apache-2.0.txt)
 - yasna@0.5.2 (Apache-2.0.txt)
@@ -9450,6 +9483,32 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
+9dde4a6ad496606322ae0b61b70dc7123fa231be543caa0896d567e34d20fbf8
+----------------------------------------------------------------
+Used by:
+- hex@0.4.3 (LICENSE-MIT)
+
+Copyright (c) 2013-2014 The Rust Project Developers.
+Copyright (c) 2015-2020 The rust-hex Developers
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
 9e0027807b0c548ac1df1bd85fe0d72da6665498b06ebf8a64d5cb841f39fcef
 ----------------------------------------------------------------
 Used by:
@@ -9998,6 +10057,33 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
+b70b1cc58b6d09afc7bfba35c45cc8613d121563acc5b9cbc519ae3b9a10af8d
+----------------------------------------------------------------
+Used by:
+- asn1_der@0.7.7 (MIT.txt)
+
+Copyright notice: not included in the published crate
+Cargo authors: KizzyCode Software Labs./Keziah Biermann <development@kizzycode.de>
+Source: https://github.com/KizzyCode/asn1_der-rust
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
 b8777f2b9ad6f8ef48e077876144281fb9683f77b5944b40d720706e01a18d80
 ----------------------------------------------------------------
 Used by:
@@ -10405,6 +10491,7 @@ c5accbbd8546e94c34aed24afe689a617627d18eed5a6c48277e48db57c23851
 ----------------------------------------------------------------
 Used by:
 - enum-as-inner@0.6.1 (LICENSE-APACHE)
+- hex@0.4.3 (LICENSE-APACHE)
 - resolv-conf@0.7.6 (LICENSE-APACHE)
 
                                  Apache License
@@ -12319,6 +12406,33 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
+e35e8f8a37b546c01c7eb82d11d7554bb6292a29fc6147c21765d1e9c40b2bae
+----------------------------------------------------------------
+Used by:
+- crunchy@0.2.4 (LICENSE)
+
+The MIT License (MIT)
+
+Copyright 2017-2023 Eira Fransham.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
 e915669a595b11a200873df8286561881b0e04932f6412a585db6297ba0bc97c
 ----------------------------------------------------------------
 Used by:
diff --git a/packages/cli/src/__tests__/runtime-host-service-manager.test.ts b/packages/cli/src/__tests__/runtime-host-service-manager.test.ts
index 2db5fee813..2c3945ac21 100644
--- a/packages/cli/src/__tests__/runtime-host-service-manager.test.ts
+++ b/packages/cli/src/__tests__/runtime-host-service-manager.test.ts
@@ -38,6 +38,7 @@ import {
   RUNTIME_HOST_OPERATOR_ACCESS_MANAGEMENT_CAPABILITY,
   RUNTIME_HOST_OPERATOR_CAPABILITY_REQUEST_ENV,
   RUNTIME_HOST_OPERATOR_PEER_MANAGEMENT_CAPABILITY,
+  RUNTIME_HOST_OPERATOR_PEER_RELAY_DISCOVERY_CAPABILITY,
   RUNTIME_HOST_OPERATOR_PROJECT_DIRECTORY_CONFIGURATION_REQUEST_ENV,
   RUNTIME_HOST_OPERATOR_PROCESS_LIFETIME_LOCK_CAPABILITY,
   RUNTIME_HOST_SERVICE_LOG_MAX_BYTES,
@@ -160,6 +161,7 @@ describe('managed Runtime Host service', () => {
         '--listen',
         '/ip4/0.0.0.0/udp/44001/quic-v1',
         '--clear-coordination-relays',
+        '--no-automatic-relay-discovery',
         '--allow-interrupt-active-tasks',
         '--expected-service-id',
         'b'.repeat(64),
@@ -179,6 +181,7 @@ describe('managed Runtime Host service', () => {
         framed: true,
         listenAddresses: ['/ip4/0.0.0.0/udp/44001/quic-v1'],
         coordinationRelays: [],
+        automaticRelayDiscovery: false,
         allowInterruptActiveTasks: true,
         managedRootId: 'a'.repeat(64),
         operatorDeploymentId: '00000000-0000-4000-8000-000000000001',
@@ -1795,6 +1798,16 @@ describe('managed Runtime Host service', () => {
       [RUNTIME_HOST_OPERATOR_PEER_MANAGEMENT_CAPABILITY],
     );
 
+    process.env[RUNTIME_HOST_OPERATOR_CAPABILITY_REQUEST_ENV] =
+      RUNTIME_HOST_OPERATOR_PEER_RELAY_DISCOVERY_CAPABILITY;
+    const relayDiscoveryFrame = decodeRuntimeHostServiceManagementFrame(await run());
+    assert.deepEqual(
+      relayDiscoveryFrame?.kind === 'result' && relayDiscoveryFrame.action === 'status'
+        ? relayDiscoveryFrame.operatorCapabilities
+        : undefined,
+      [RUNTIME_HOST_OPERATOR_PEER_RELAY_DISCOVERY_CAPABILITY],
+    );
+
     process.env[RUNTIME_HOST_OPERATOR_CAPABILITY_REQUEST_ENV] =
       RUNTIME_HOST_OPERATOR_ACCESS_MANAGEMENT_CAPABILITY;
     process.env[RUNTIME_HOST_OPERATOR_PROJECT_DIRECTORY_CONFIGURATION_REQUEST_ENV] = '1';
diff --git a/packages/cli/src/cli-core.ts b/packages/cli/src/cli-core.ts
index f2d9e286e4..7a7f1881fa 100644
--- a/packages/cli/src/cli-core.ts
+++ b/packages/cli/src/cli-core.ts
@@ -213,6 +213,13 @@ function helpText(cliCommand: string): string {
     '  --websocket-path <path>       Persist the upgrade path (default: /runtime-host)',
     '  --json                        Emit framed machine-readable progress and result records',
     '',
+    'Managed Runtime Host direct-peer options:',
+    '  --listen <multiaddr>          Persist a listener address (repeatable)',
+    '  --coordination-relay <addr>   Prefer a Circuit Relay v2 address (repeatable)',
+    '  --clear-coordination-relays   Remove every manually configured relay',
+    '  --automatic-relay-discovery   Enable best-effort public relay discovery',
+    '  --no-automatic-relay-discovery  Disable public discovery and retain manual relays',
+    '',
     'Runtime Host access issue options:',
     '  --root <path>                 Select the canonical data root',
     '  --kind <kind>                 remote-owner or capability-provider',
@@ -317,6 +324,7 @@ export async function runMakaCli(
                   expectedPeerId: peer.peerId,
                   listenAddresses: peer.listenAddresses,
                   coordinationRelays: peer.coordinationRelays,
+                  automaticRelayDiscovery: peer.automaticRelayDiscovery,
                   meshDataRoot: join(config.deploymentRoot, 'peer-mesh'),
                 },
               }
@@ -475,6 +483,10 @@ export async function runMakaCli(
         operatorDeploymentId: command.operatorDeploymentId,
         listenAddresses: command.listenAddresses,
         ...(command.coordinationRelays ? { coordinationRelays: command.coordinationRelays } : {}),
+        ...(command.automaticRelayDiscovery === undefined
+          ? {}
+          : { automaticRelayDiscovery: command.automaticRelayDiscovery }),
+        ...(command.relayDiscoveryStatus ? { relayDiscoveryStatus: true } : {}),
         ...(command.expectedTarget ? { expectedTarget: command.expectedTarget } : {}),
         ...(command.allowInterruptActiveTasks ? { allowInterruptActiveTasks: true } : {}),
       });
diff --git a/packages/cli/src/runtime-host-cli.ts b/packages/cli/src/runtime-host-cli.ts
index ca9ea69d15..d2bc06b030 100644
--- a/packages/cli/src/runtime-host-cli.ts
+++ b/packages/cli/src/runtime-host-cli.ts
@@ -165,6 +165,8 @@ export type RuntimeHostCliCommand =
       operatorDeploymentId: string;
       listenAddresses: string[];
       coordinationRelays?: string[];
+      automaticRelayDiscovery?: boolean;
+      relayDiscoveryStatus?: true;
       expectedTarget?: RuntimeHostManagedServiceTarget;
       allowInterruptActiveTasks?: true;
     }
@@ -892,6 +894,8 @@ function parseServicePeerCommand(argv: string[]): RuntimeHostCliCommand {
   const listenAddresses: string[] = [];
   const coordinationRelays: string[] = [];
   let clearCoordinationRelays = false;
+  let automaticRelayDiscovery: boolean | undefined;
+  let relayDiscoveryStatus = false;
   let allowInterruptActiveTasks = false;
   const options = parseManagedServiceOptions(argv.slice(1), {
     allowConfiguration: false,
@@ -905,6 +909,22 @@ function parseServicePeerCommand(argv: string[]): RuntimeHostCliCommand {
         if (allowInterruptActiveTasks) return error('Duplicate --allow-interrupt-active-tasks');
         allowInterruptActiveTasks = true;
       },
+      '--automatic-relay-discovery': () => {
+        if (automaticRelayDiscovery !== undefined) {
+          return error('Relay discovery mode was specified more than once');
+        }
+        automaticRelayDiscovery = true;
+      },
+      '--no-automatic-relay-discovery': () => {
+        if (automaticRelayDiscovery !== undefined) {
+          return error('Relay discovery mode was specified more than once');
+        }
+        automaticRelayDiscovery = false;
+      },
+      '--relay-discovery-status': () => {
+        if (relayDiscoveryStatus) return error('Duplicate --relay-discovery-status');
+        relayDiscoveryStatus = true;
+      },
     },
     valueOptions: {
       '--client-data-root': (value) => {
@@ -924,6 +944,9 @@ function parseServicePeerCommand(argv: string[]): RuntimeHostCliCommand {
   if (options.framed && (action === 'rotate' || action === 'descriptor')) {
     return error(`runtime-host service peer ${action} does not support --framed`);
   }
+  if (relayDiscoveryStatus && !options.framed) {
+    return error('--relay-discovery-status requires --framed');
+  }
   if (listenAddresses.some(hasEphemeralRuntimeHostPeerPort)) {
     return error('--listen requires a stable non-zero transport port');
   }
@@ -932,11 +955,12 @@ function parseServicePeerCommand(argv: string[]): RuntimeHostCliCommand {
   }
   if (
     action !== 'enable' &&
-    (listenAddresses.length > 0 || coordinationRelays.length > 0 || clearCoordinationRelays)
+    (listenAddresses.length > 0 ||
+      coordinationRelays.length > 0 ||
+      clearCoordinationRelays ||
+      automaticRelayDiscovery !== undefined)
   ) {
-    return error(
-      '--listen, --coordination-relay, and --clear-coordination-relays are only valid with peer enable',
-    );
+    return error('Peer listener options are only valid with peer enable');
   }
   if (allowInterruptActiveTasks && action !== 'enable' && action !== 'disable') {
     return error('--allow-interrupt-active-tasks is only valid with peer enable or peer disable');
@@ -969,6 +993,8 @@ function parseServicePeerCommand(argv: string[]): RuntimeHostCliCommand {
       : coordinationRelays.length > 0
         ? { coordinationRelays }
         : {}),
+    ...(automaticRelayDiscovery === undefined ? {} : { automaticRelayDiscovery }),
+    ...(relayDiscoveryStatus ? { relayDiscoveryStatus: true as const } : {}),
     ...(options.expectedTarget ? { expectedTarget: options.expectedTarget } : {}),
     ...(allowInterruptActiveTasks ? { allowInterruptActiveTasks: true } : {}),
   };
diff --git a/packages/cli/src/runtime-host-peer-management-command.ts b/packages/cli/src/runtime-host-peer-management-command.ts
index d80b0b748e..80a5de2a56 100644
--- a/packages/cli/src/runtime-host-peer-management-command.ts
+++ b/packages/cli/src/runtime-host-peer-management-command.ts
@@ -73,6 +73,8 @@ export interface RuntimeHostPeerManagementCliOptions {
   readonly operatorDeploymentId: string;
   readonly listenAddresses: readonly string[];
   readonly coordinationRelays?: readonly string[];
+  readonly automaticRelayDiscovery?: boolean;
+  readonly relayDiscoveryStatus?: boolean;
   readonly expectedTarget?: RuntimeHostManagedServiceTarget;
   readonly allowInterruptActiveTasks?: boolean;
 }
@@ -251,13 +253,14 @@ async function runCanonicalRuntimeHostPeerManagementLocked(
     if (options.action === 'descriptor') {
       throw new TypeError('Direct-peer descriptor does not support framed output');
     }
+    const framedStatus = options.relayDiscoveryStatus ? status : omitRelayDiscoveryStatus(status);
     writePeerFrame(
       options.action === 'status'
-        ? { kind: 'result', action: options.action, status }
+        ? { kind: 'result', action: options.action, status: framedStatus }
         : {
             kind: 'result',
             action: options.action,
-            status,
+            status: framedStatus,
             restarted: restarted!,
           },
       deps,
@@ -274,6 +277,11 @@ async function runCanonicalRuntimeHostPeerManagementLocked(
   return 0;
 }
 
+function omitRelayDiscoveryStatus(status: RuntimeHostPeerStatus): RuntimeHostPeerStatus {
+  const { automaticRelayDiscovery: _automaticRelayDiscovery, ...legacy } = status;
+  return legacy;
+}
+
 async function prepareCanonicalPeer(
   options: RuntimeHostPeerManagementCliOptions,
   config: Awaited<ReturnType<typeof resolveRuntimeHostManagedDeployment>>['config'],
@@ -312,6 +320,8 @@ async function prepareCanonicalPeer(
     coordinationRelays: [
       ...new Set(options.coordinationRelays ?? current?.coordinationRelays ?? []),
     ],
+    automaticRelayDiscovery:
+      options.automaticRelayDiscovery ?? current?.automaticRelayDiscovery ?? true,
   };
 }
 
@@ -340,6 +350,7 @@ async function readCanonicalPeerStatus(
       serviceState: result.service.state,
       routeHints: [],
       coordinationRelays: [],
+      automaticRelayDiscovery: true,
     };
   }
   return {
@@ -349,6 +360,7 @@ async function readCanonicalPeerStatus(
     rootId: config.root.id,
     routeHints: expandWildcardListenAddresses(peer.listenAddresses),
     coordinationRelays: [...peer.coordinationRelays],
+    automaticRelayDiscovery: peer.automaticRelayDiscovery,
   };
 }
 
diff --git a/packages/cli/src/runtime-host-service-command.ts b/packages/cli/src/runtime-host-service-command.ts
index a84e335b86..53059736a2 100644
--- a/packages/cli/src/runtime-host-service-command.ts
+++ b/packages/cli/src/runtime-host-service-command.ts
@@ -49,6 +49,7 @@ export interface RuntimeHostServiceCliOptions {
     readonly expectedPeerId?: string;
     readonly listenAddresses?: readonly string[];
     readonly coordinationRelays?: readonly string[];
+    readonly automaticRelayDiscovery?: boolean;
     readonly meshDataRoot?: string;
   };
 }
diff --git a/packages/cli/src/runtime-host-service-management-command.ts b/packages/cli/src/runtime-host-service-management-command.ts
index 99dde97f04..42260ca5d8 100644
--- a/packages/cli/src/runtime-host-service-management-command.ts
+++ b/packages/cli/src/runtime-host-service-management-command.ts
@@ -25,6 +25,7 @@ import {
   RUNTIME_HOST_OPERATOR_ACCESS_MANAGEMENT_CAPABILITY,
   RUNTIME_HOST_OPERATOR_CAPABILITY_REQUEST_ENV,
   RUNTIME_HOST_OPERATOR_PEER_MANAGEMENT_CAPABILITY,
+  RUNTIME_HOST_OPERATOR_PEER_RELAY_DISCOVERY_CAPABILITY,
   RUNTIME_HOST_OPERATOR_PROJECT_DIRECTORY_CONFIGURATION_REQUEST_ENV,
   RUNTIME_HOST_OPERATOR_PROCESS_LIFETIME_LOCK_CAPABILITY,
   RUNTIME_HOST_SERVICE_ERROR_CODE_MAX_BYTES,
@@ -423,6 +424,7 @@ function requestedOperatorCapabilities(): {
   if (
     requested === RUNTIME_HOST_OPERATOR_ACCESS_MANAGEMENT_CAPABILITY ||
     requested === RUNTIME_HOST_OPERATOR_PEER_MANAGEMENT_CAPABILITY ||
+    requested === RUNTIME_HOST_OPERATOR_PEER_RELAY_DISCOVERY_CAPABILITY ||
     requested === RUNTIME_HOST_OPERATOR_PROCESS_LIFETIME_LOCK_CAPABILITY
   ) {
     capabilities.push(requested);
diff --git a/packages/cli/src/runtime-host-setup-command.ts b/packages/cli/src/runtime-host-setup-command.ts
index 55c912172c..275213356a 100644
--- a/packages/cli/src/runtime-host-setup-command.ts
+++ b/packages/cli/src/runtime-host-setup-command.ts
@@ -651,6 +651,7 @@ async function prepareSupervisedDirectPeer(
     coordinationRelays: [
       ...(options.directPeer?.coordinationRelays ?? current?.coordinationRelays ?? []),
     ],
+    automaticRelayDiscovery: current?.automaticRelayDiscovery ?? true,
   };
 }
 
diff --git a/packages/runtime-host/src/__tests__/peer-management-frame.test.ts b/packages/runtime-host/src/__tests__/peer-management-frame.test.ts
index 2bd158ffbf..40ea81a051 100644
--- a/packages/runtime-host/src/__tests__/peer-management-frame.test.ts
+++ b/packages/runtime-host/src/__tests__/peer-management-frame.test.ts
@@ -36,6 +36,7 @@ test('peer management frames preserve a bounded machine-readable descriptor', ()
       rootId: 'a'.repeat(64),
       routeHints: ['/ip4/192.0.2.1/udp/41000/quic-v1'],
       coordinationRelays: [],
+      automaticRelayDiscovery: true,
     },
   };
   assert.deepEqual(
diff --git a/packages/runtime-host/src/__tests__/peer-native.test.ts b/packages/runtime-host/src/__tests__/peer-native.test.ts
index 1568f677bc..7dad8c1388 100644
--- a/packages/runtime-host/src/__tests__/peer-native.test.ts
+++ b/packages/runtime-host/src/__tests__/peer-native.test.ts
@@ -60,6 +60,7 @@ module.exports = {
     return {
       peerId: 'client',
       listenAddresses: [],
+      activeCoordinationRelays: [],
       connect: ({ requestId, peerId, routeHints, coordinationRelays }) => {
         stats.requests.push({ requestId, peerId, routeHints, coordinationRelays });
         if (peerId === 'ready') return Promise.resolve(stream);
@@ -198,6 +199,7 @@ module.exports = {
   startPeerEndpoint: () => ({
     peerId: 'peer',
     listenAddresses: [],
+    activeCoordinationRelays: [],
     connect: async () => stream,
     connectMeshControl: async () => stream,
     cancelConnect: async () => true,
diff --git a/packages/runtime-host/src/client/peer-client.ts b/packages/runtime-host/src/client/peer-client.ts
index 6464bfdfba..59020d7458 100644
--- a/packages/runtime-host/src/client/peer-client.ts
+++ b/packages/runtime-host/src/client/peer-client.ts
@@ -76,6 +76,7 @@ export function createRuntimeHostPeerClientFromEnvironment(
   options: {
     readonly listenAddresses?: readonly string[];
     readonly coordinationRelays?: readonly string[];
+    readonly automaticRelayDiscovery?: boolean;
     readonly routeResolver?: RuntimeHostPeerRouteResolver;
   } = {},
 ): RuntimeHostPeerClient {
@@ -96,6 +97,7 @@ export function createRuntimeHostPeerClient(input: {
   readonly expectedPeerId?: string;
   readonly listenAddresses?: readonly string[];
   readonly coordinationRelays?: readonly string[];
+  readonly automaticRelayDiscovery?: boolean;
   readonly routeResolver?: RuntimeHostPeerRouteResolver;
 }): RuntimeHostPeerClient {
   return new RuntimeHostPeerClientImpl(input);
@@ -107,6 +109,7 @@ class RuntimeHostPeerClientImpl implements RuntimeHostPeerClient {
   readonly #expectedPeerId: string | undefined;
   readonly #listenAddresses: readonly string[] | undefined;
   readonly #coordinationRelays: readonly string[] | undefined;
+  readonly #automaticRelayDiscovery: boolean;
   readonly #routeResolver: RuntimeHostPeerRouteResolver | undefined;
   #endpoint: RuntimeHostPeerNativeEndpoint | undefined;
   #draining: Promise<void> | undefined;
@@ -125,6 +128,7 @@ class RuntimeHostPeerClientImpl implements RuntimeHostPeerClient {
     readonly expectedPeerId?: string;
     readonly listenAddresses?: readonly string[];
     readonly coordinationRelays?: readonly string[];
+    readonly automaticRelayDiscovery?: boolean;
     readonly routeResolver?: RuntimeHostPeerRouteResolver;
   }) {
     this.#nativePath = input.nativePath;
@@ -132,6 +136,7 @@ class RuntimeHostPeerClientImpl implements RuntimeHostPeerClient {
     this.#expectedPeerId = input.expectedPeerId;
     this.#listenAddresses = input.listenAddresses;
     this.#coordinationRelays = input.coordinationRelays;
+    this.#automaticRelayDiscovery = input.automaticRelayDiscovery ?? false;
     this.#routeResolver = input.routeResolver;
   }
 
@@ -144,7 +149,7 @@ class RuntimeHostPeerClientImpl implements RuntimeHostPeerClient {
     return Object.freeze({
       peerId: endpoint.peerId,
       listenAddresses: Object.freeze([...endpoint.listenAddresses]),
-      coordinationRelays: Object.freeze([...(this.#coordinationRelays ?? [])]),
+      coordinationRelays: Object.freeze([...endpoint.activeCoordinationRelays]),
     });
   }
 
@@ -328,6 +333,7 @@ class RuntimeHostPeerClientImpl implements RuntimeHostPeerClient {
       ...(this.#expectedPeerId ? { expectedPeerId: this.#expectedPeerId } : {}),
       ...(this.#listenAddresses ? { listenAddresses: this.#listenAddresses } : {}),
       ...(this.#coordinationRelays ? { coordinationRelays: this.#coordinationRelays } : {}),
+      automaticRelayDiscovery: this.#automaticRelayDiscovery,
     });
     this.#endpoint = endpoint;
     this.#draining = this.#drainInbound(endpoint);
diff --git a/packages/runtime-host/src/operator/index.ts b/packages/runtime-host/src/operator/index.ts
index 20e73a8587..90f4d4a129 100644
--- a/packages/runtime-host/src/operator/index.ts
+++ b/packages/runtime-host/src/operator/index.ts
@@ -59,6 +59,7 @@ export {
   RUNTIME_HOST_OPERATOR_ACCESS_MANAGEMENT_CAPABILITY,
   RUNTIME_HOST_OPERATOR_CAPABILITY_REQUEST_ENV,
   RUNTIME_HOST_OPERATOR_PEER_MANAGEMENT_CAPABILITY,
+  RUNTIME_HOST_OPERATOR_PEER_RELAY_DISCOVERY_CAPABILITY,
   RUNTIME_HOST_OPERATOR_PROJECT_DIRECTORY_CONFIGURATION_REQUEST_ENV,
   RUNTIME_HOST_OPERATOR_PROCESS_LIFETIME_LOCK_CAPABILITY,
   RUNTIME_HOST_OPERATOR_UPDATE_SCHEDULER_CAPABILITY,
diff --git a/packages/runtime-host/src/operator/managed-deployment.ts b/packages/runtime-host/src/operator/managed-deployment.ts
index 9aaa6d297e..69de37ee75 100644
--- a/packages/runtime-host/src/operator/managed-deployment.ts
+++ b/packages/runtime-host/src/operator/managed-deployment.ts
@@ -176,6 +176,7 @@ const managedDeploymentConfigSchema = z
             peerId: boundedText(256),
             listenAddresses: z.array(boundedText(2_048)).min(1).max(16),
             coordinationRelays: z.array(boundedText(2_048)).max(16),
+            automaticRelayDiscovery: z.boolean().default(true),
           })
           .strict()
           .optional(),
diff --git a/packages/runtime-host/src/operator/peer-management-frame.ts b/packages/runtime-host/src/operator/peer-management-frame.ts
index d216179ec7..6c53370da5 100644
--- a/packages/runtime-host/src/operator/peer-management-frame.ts
+++ b/packages/runtime-host/src/operator/peer-management-frame.ts
@@ -37,6 +37,7 @@ const STATUS_SCHEMA = z
       .optional(),
     routeHints: z.array(ADDRESS_SCHEMA).max(16),
     coordinationRelays: z.array(ADDRESS_SCHEMA).max(16),
+    automaticRelayDiscovery: z.boolean().optional(),
   })
   .strict();
 
diff --git a/packages/runtime-host/src/operator/service-management-frame.ts b/packages/runtime-host/src/operator/service-management-frame.ts
index f8d431e110..dfbe301a0b 100644
--- a/packages/runtime-host/src/operator/service-management-frame.ts
+++ b/packages/runtime-host/src/operator/service-management-frame.ts
@@ -35,6 +35,7 @@ export const RUNTIME_HOST_OPERATOR_PROJECT_DIRECTORY_CONFIGURATION_REQUEST_ENV =
   'MAKA_RUNTIME_HOST_OPERATOR_PROJECT_DIRECTORY_CONFIGURATION_REQUEST';
 export const RUNTIME_HOST_OPERATOR_PROCESS_LIFETIME_LOCK_CAPABILITY = 'process-lifetime-lock-v1';
 export const RUNTIME_HOST_OPERATOR_PEER_MANAGEMENT_CAPABILITY = 'peer-management-v1';
+export const RUNTIME_HOST_OPERATOR_PEER_RELAY_DISCOVERY_CAPABILITY = 'peer-relay-discovery-v1';
 export const RUNTIME_HOST_OPERATOR_UPDATE_SCHEDULER_CAPABILITY = 'update-scheduler-v1';
 export const RUNTIME_HOST_OPERATOR_CAPABILITY_REQUEST_ENV =
   'MAKA_RUNTIME_HOST_OPERATOR_CAPABILITY_REQUEST';
@@ -91,6 +92,7 @@ const SERVICE_STATES = ['not_installed', ...INSTALLED_SERVICE_STATES] as const;
 const OPERATOR_CAPABILITIES = [
   RUNTIME_HOST_OPERATOR_ACCESS_MANAGEMENT_CAPABILITY,
   RUNTIME_HOST_OPERATOR_PEER_MANAGEMENT_CAPABILITY,
+  RUNTIME_HOST_OPERATOR_PEER_RELAY_DISCOVERY_CAPABILITY,
   RUNTIME_HOST_OPERATOR_PROCESS_LIFETIME_LOCK_CAPABILITY,
   RUNTIME_HOST_OPERATOR_UPDATE_SCHEDULER_CAPABILITY,
 ] as const;
diff --git a/packages/runtime-host/src/peer-mesh/owner.ts b/packages/runtime-host/src/peer-mesh/owner.ts
index 8c62ce623e..3f1560154e 100644
--- a/packages/runtime-host/src/peer-mesh/owner.ts
+++ b/packages/runtime-host/src/peer-mesh/owner.ts
@@ -41,6 +41,7 @@ export async function openRuntimeHostPeerMeshOwner(input: {
   readonly dataRoot: string;
   readonly listenAddresses?: readonly string[];
   readonly coordinationRelays?: readonly string[];
+  readonly automaticRelayDiscovery?: boolean;
 }): Promise<RuntimeHostPeerMeshOwner> {
   let mesh: PeerMeshNode | undefined;
   let resolverMesh: PeerMeshNode | undefined;
@@ -55,6 +56,9 @@ export async function openRuntimeHostPeerMeshOwner(input: {
       ...(input.expectedPeerId ? { expectedPeerId: input.expectedPeerId } : {}),
       ...(input.listenAddresses ? { listenAddresses: input.listenAddresses } : {}),
       ...(input.coordinationRelays ? { coordinationRelays: input.coordinationRelays } : {}),
+      ...(input.automaticRelayDiscovery === undefined
+        ? {}
+        : { automaticRelayDiscovery: input.automaticRelayDiscovery }),
       routeResolver: {
         resolveRoutes: (peerId) => resolverMesh?.resolveRoutes(peerId),
       },
diff --git a/packages/runtime-host/src/server/peer-listener.ts b/packages/runtime-host/src/server/peer-listener.ts
index 5e538bbabf..11db805abb 100644
--- a/packages/runtime-host/src/server/peer-listener.ts
+++ b/packages/runtime-host/src/server/peer-listener.ts
@@ -42,6 +42,7 @@ export interface RuntimeHostPeerListenerConfiguration {
   readonly expectedPeerId?: string;
   readonly listenAddresses?: readonly string[];
   readonly coordinationRelays?: readonly string[];
+  readonly automaticRelayDiscovery?: boolean;
 }
 
 export type RuntimeHostPeerListenerEndpointOptions =
diff --git a/packages/runtime-host/src/transport/peer-native.ts b/packages/runtime-host/src/transport/peer-native.ts
index 0b1106264a..c9f362dc9a 100644
--- a/packages/runtime-host/src/transport/peer-native.ts
+++ b/packages/runtime-host/src/transport/peer-native.ts
@@ -62,6 +62,7 @@ export interface RuntimeHostPeerIdentityProof {
 export interface RuntimeHostPeerNativeEndpoint {
   readonly peerId: string;
   readonly listenAddresses: readonly string[];
+  readonly activeCoordinationRelays: readonly string[];
   connect(options: {
     readonly requestId: number;
     readonly peerId: string;
@@ -100,6 +101,7 @@ interface RuntimeHostPeerNativeModule {
     readonly expectedPeerId?: string;
     readonly listenAddresses?: readonly string[];
     readonly coordinationRelays?: readonly string[];
+    readonly automaticRelayDiscovery?: boolean;
   }): unknown;
 }
 
@@ -170,6 +172,7 @@ export function startRuntimeHostPeerEndpoint(input: {
   readonly expectedPeerId?: string;
   readonly listenAddresses?: readonly string[];
   readonly coordinationRelays?: readonly string[];
+  readonly automaticRelayDiscovery?: boolean;
 }): RuntimeHostPeerNativeEndpoint {
   try {
     const endpoint = loadNativeModule(input.nativePath).startPeerEndpoint({
@@ -177,6 +180,9 @@ export function startRuntimeHostPeerEndpoint(input: {
       ...(input.expectedPeerId ? { expectedPeerId: input.expectedPeerId } : {}),
       ...(input.listenAddresses ? { listenAddresses: input.listenAddresses } : {}),
       ...(input.coordinationRelays ? { coordinationRelays: input.coordinationRelays } : {}),
+      ...(input.automaticRelayDiscovery === undefined
+        ? {}
+        : { automaticRelayDiscovery: input.automaticRelayDiscovery }),
     });
     if (!isPeerNativeEndpoint(endpoint)) {
       throw new RuntimeHostPeerError(
@@ -442,6 +448,9 @@ function isPeerNativeEndpoint(value: unknown): value is RuntimeHostPeerNativeEnd
     'listenAddresses' in value &&
     Array.isArray(value.listenAddresses) &&
     value.listenAddresses.every((address) => typeof address === 'string') &&
+    'activeCoordinationRelays' in value &&
+    Array.isArray(value.activeCoordinationRelays) &&
+    value.activeCoordinationRelays.every((address) => typeof address === 'string') &&
     'connect' in value &&
     typeof value.connect === 'function' &&
     'connectMeshControl' in value &&
diff --git a/scripts/generate-runtime-host-peer-notices.mjs b/scripts/generate-runtime-host-peer-notices.mjs
index ce9a7bb0f4..5cf6b719dc 100644
--- a/scripts/generate-runtime-host-peer-notices.mjs
+++ b/scripts/generate-runtime-host-peer-notices.mjs
@@ -104,7 +104,11 @@ function declaredLicenseFallback(pkg, source) {
       text: apache2LicenseText,
     };
   }
-  if (pkg.license === 'MIT') {
+  if (
+    pkg.license
+      .split(/\s+OR\s+/u)
+      .some((alternative) => alternative.replaceAll(/[()]/gu, '').trim() === 'MIT')
+  ) {
     const authors = pkg.authors.length > 0 ? pkg.authors.join(', ') : 'not included';
     return {
       name: 'MIT.txt',