diff --git a/.gitignore b/.gitignore
index b90fd1e..44e9d4d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -35,3 +35,4 @@ turn-harvesting-idea.md
 # Private tooling (closed-source)
 ostp-prober/
 
+ostp-brain/
diff --git a/Cargo.lock b/Cargo.lock
index 54f49b1..35b6600 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -157,10 +157,10 @@ dependencies = [
  "bytes",
  "form_urlencoded",
  "futures-util",
- "http",
- "http-body",
+ "http 1.4.0",
+ "http-body 1.0.1",
  "http-body-util",
- "hyper",
+ "hyper 1.9.0",
  "hyper-util",
  "itoa",
  "matchit",
@@ -172,7 +172,7 @@ dependencies = [
  "serde_json",
  "serde_path_to_error",
  "serde_urlencoded",
- "sync_wrapper",
+ "sync_wrapper 1.0.2",
  "tokio",
  "tower",
  "tower-layer",
@@ -188,17 +188,23 @@ checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
 dependencies = [
  "bytes",
  "futures-core",
- "http",
- "http-body",
+ "http 1.4.0",
+ "http-body 1.0.1",
  "http-body-util",
  "mime",
  "pin-project-lite",
- "sync_wrapper",
+ "sync_wrapper 1.0.2",
  "tower-layer",
  "tower-service",
  "tracing",
 ]
 
+[[package]]
+name = "base64"
+version = "0.21.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
+
 [[package]]
 name = "base64"
 version = "0.22.1"
@@ -407,6 +413,16 @@ dependencies = [
  "crossbeam-utils",
 ]
 
+[[package]]
+name = "core-foundation"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "core-foundation-sys"
 version = "0.8.7"
@@ -537,6 +553,21 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "either"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+
+[[package]]
+name = "encoding_rs"
+version = "0.8.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
+dependencies = [
+ "cfg-if",
+]
+
 [[package]]
 name = "equivalent"
 version = "1.0.2"
@@ -601,6 +632,12 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
 
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
 [[package]]
 name = "foldhash"
 version = "0.1.5"
@@ -774,6 +811,25 @@ dependencies = [
  "polyval",
 ]
 
+[[package]]
+name = "h2"
+version = "0.3.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0beca50380b1fc32983fc1cb4587bfa4bb9e78fc259aad4a0032d2080309222d"
+dependencies = [
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "futures-util",
+ "http 0.2.12",
+ "indexmap",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
 [[package]]
 name = "hash32"
 version = "0.3.1"
@@ -838,6 +894,17 @@ dependencies = [
  "digest",
 ]
 
+[[package]]
+name = "http"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1"
+dependencies = [
+ "bytes",
+ "fnv",
+ "itoa",
+]
+
 [[package]]
 name = "http"
 version = "1.4.0"
@@ -848,6 +915,17 @@ dependencies = [
  "itoa",
 ]
 
+[[package]]
+name = "http-body"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
+dependencies = [
+ "bytes",
+ "http 0.2.12",
+ "pin-project-lite",
+]
+
 [[package]]
 name = "http-body"
 version = "1.0.1"
@@ -855,7 +933,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
 dependencies = [
  "bytes",
- "http",
+ "http 1.4.0",
 ]
 
 [[package]]
@@ -866,8 +944,8 @@ checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
 dependencies = [
  "bytes",
  "futures-core",
- "http",
- "http-body",
+ "http 1.4.0",
+ "http-body 1.0.1",
  "pin-project-lite",
 ]
 
@@ -883,6 +961,30 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
+[[package]]
+name = "hyper"
+version = "0.14.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41dfc780fdec9373c01bae43289ea34c972e40ee3c9f6b3c8801a35f35586ce7"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http 0.2.12",
+ "http-body 0.4.6",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "socket2 0.5.10",
+ "tokio",
+ "tower-service",
+ "tracing",
+ "want",
+]
+
 [[package]]
 name = "hyper"
 version = "1.9.0"
@@ -893,8 +995,8 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-core",
- "http",
- "http-body",
+ "http 1.4.0",
+ "http-body 1.0.1",
  "httparse",
  "httpdate",
  "itoa",
@@ -904,18 +1006,32 @@ dependencies = [
  "want",
 ]
 
+[[package]]
+name = "hyper-rustls"
+version = "0.24.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec3efd23720e2049821a693cbc7e65ea87c72f1c58ff2f9522ff332b1491e590"
+dependencies = [
+ "futures-util",
+ "http 0.2.12",
+ "hyper 0.14.32",
+ "rustls 0.21.12",
+ "tokio",
+ "tokio-rustls 0.24.1",
+]
+
 [[package]]
 name = "hyper-rustls"
 version = "0.27.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
 dependencies = [
- "http",
- "hyper",
+ "http 1.4.0",
+ "hyper 1.9.0",
  "hyper-util",
- "rustls",
+ "rustls 0.23.40",
  "tokio",
- "tokio-rustls",
+ "tokio-rustls 0.26.4",
  "tower-service",
  "webpki-roots 1.0.7",
 ]
@@ -926,18 +1042,18 @@ version = "0.1.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "bytes",
  "futures-channel",
  "futures-util",
- "http",
- "http-body",
- "hyper",
+ "http 1.4.0",
+ "http-body 1.0.1",
+ "hyper 1.9.0",
  "ipnet",
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2",
+ "socket2 0.6.3",
  "tokio",
  "tower-service",
  "tracing",
@@ -1355,7 +1471,7 @@ name = "ostp"
 version = "0.2.73"
 dependencies = [
  "anyhow",
- "base64",
+ "base64 0.22.1",
  "clap",
  "json_comments",
  "ostp-client",
@@ -1370,12 +1486,25 @@ dependencies = [
  "url",
 ]
 
+[[package]]
+name = "ostp-brain"
+version = "0.1.0"
+dependencies = [
+ "chrono",
+ "rand 0.8.5",
+ "reqwest 0.11.27",
+ "serde",
+ "serde_json",
+ "tokio",
+ "url",
+]
+
 [[package]]
 name = "ostp-client"
 version = "0.2.73"
 dependencies = [
  "anyhow",
- "base64",
+ "base64 0.22.1",
  "bytes",
  "chacha20poly1305",
  "chrono",
@@ -1392,7 +1521,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sha2",
- "socket2",
+ "socket2 0.6.3",
  "tokio",
  "tracing",
  "tun",
@@ -1440,7 +1569,7 @@ version = "0.2.73"
 dependencies = [
  "anyhow",
  "axum",
- "base64",
+ "base64 0.22.1",
  "bytes",
  "chacha20poly1305",
  "futures-util",
@@ -1451,13 +1580,13 @@ dependencies = [
  "ostp-core",
  "portable-atomic",
  "rand 0.8.5",
- "reqwest",
+ "reqwest 0.12.28",
  "rust-embed",
  "serde",
  "serde_json",
  "sha2",
  "simple-dns",
- "socket2",
+ "socket2 0.6.3",
  "tokio",
  "tower-http",
  "tracing",
@@ -1485,6 +1614,29 @@ version = "2.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
 
+[[package]]
+name = "parking_lot"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-link",
+]
+
 [[package]]
 name = "percent-encoding"
 version = "2.3.2"
@@ -1608,8 +1760,8 @@ dependencies = [
  "quinn-proto",
  "quinn-udp",
  "rustc-hash",
- "rustls",
- "socket2",
+ "rustls 0.23.40",
+ "socket2 0.6.3",
  "thiserror 2.0.18",
  "tokio",
  "tracing",
@@ -1628,7 +1780,7 @@ dependencies = [
  "rand 0.9.4",
  "ring",
  "rustc-hash",
- "rustls",
+ "rustls 0.23.40",
  "rustls-pki-types",
  "slab",
  "thiserror 2.0.18",
@@ -1646,7 +1798,7 @@ dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
- "socket2",
+ "socket2 0.6.3",
  "tracing",
  "windows-sys 0.52.0",
 ]
@@ -1731,6 +1883,15 @@ dependencies = [
  "getrandom 0.3.4",
 ]
 
+[[package]]
+name = "redox_syscall"
+version = "0.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags 2.11.1",
+]
+
 [[package]]
 name = "regex-automata"
 version = "0.4.14"
@@ -1748,34 +1909,76 @@ version = "0.8.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
 
+[[package]]
+name = "reqwest"
+version = "0.11.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd67538700a17451e7cba03ac727fb961abb7607553461627b97de0b89cf4a62"
+dependencies = [
+ "base64 0.21.7",
+ "bytes",
+ "encoding_rs",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http 0.2.12",
+ "http-body 0.4.6",
+ "hyper 0.14.32",
+ "hyper-rustls 0.24.2",
+ "ipnet",
+ "js-sys",
+ "log",
+ "mime",
+ "once_cell",
+ "percent-encoding",
+ "pin-project-lite",
+ "rustls 0.21.12",
+ "rustls-pemfile",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sync_wrapper 0.1.2",
+ "system-configuration",
+ "tokio",
+ "tokio-rustls 0.24.1",
+ "tokio-socks",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "webpki-roots 0.25.4",
+ "winreg",
+]
+
 [[package]]
 name = "reqwest"
 version = "0.12.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "bytes",
  "futures-core",
- "http",
- "http-body",
+ "http 1.4.0",
+ "http-body 1.0.1",
  "http-body-util",
- "hyper",
- "hyper-rustls",
+ "hyper 1.9.0",
+ "hyper-rustls 0.27.9",
  "hyper-util",
  "js-sys",
  "log",
  "percent-encoding",
  "pin-project-lite",
  "quinn",
- "rustls",
+ "rustls 0.23.40",
  "rustls-pki-types",
  "serde",
  "serde_json",
  "serde_urlencoded",
- "sync_wrapper",
+ "sync_wrapper 1.0.2",
  "tokio",
- "tokio-rustls",
+ "tokio-rustls 0.26.4",
  "tower",
  "tower-http",
  "tower-service",
@@ -1849,6 +2052,18 @@ dependencies = [
  "semver",
 ]
 
+[[package]]
+name = "rustls"
+version = "0.21.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f56a14d1f48b391359b22f731fd4bd7e43c97f3c50eee276f3aa09c94784d3e"
+dependencies = [
+ "log",
+ "ring",
+ "rustls-webpki 0.101.7",
+ "sct",
+]
+
 [[package]]
 name = "rustls"
 version = "0.23.40"
@@ -1858,11 +2073,20 @@ dependencies = [
  "once_cell",
  "ring",
  "rustls-pki-types",
- "rustls-webpki",
+ "rustls-webpki 0.103.13",
  "subtle",
  "zeroize",
 ]
 
+[[package]]
+name = "rustls-pemfile"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
+dependencies = [
+ "base64 0.21.7",
+]
+
 [[package]]
 name = "rustls-pki-types"
 version = "1.14.1"
@@ -1873,6 +2097,16 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "rustls-webpki"
+version = "0.101.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
 [[package]]
 name = "rustls-webpki"
 version = "0.103.13"
@@ -1911,6 +2145,16 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
+[[package]]
+name = "sct"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
 [[package]]
 name = "semver"
 version = "1.0.28"
@@ -2071,6 +2315,16 @@ dependencies = [
  "subtle",
 ]
 
+[[package]]
+name = "socket2"
+version = "0.5.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
+dependencies = [
+ "libc",
+ "windows-sys 0.52.0",
+]
+
 [[package]]
 name = "socket2"
 version = "0.6.3"
@@ -2119,6 +2373,12 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "sync_wrapper"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
+
 [[package]]
 name = "sync_wrapper"
 version = "1.0.2"
@@ -2139,6 +2399,27 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "system-configuration"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba3a3adc5c275d719af8cb4272ea1c4a6d668a777f37e115f6d11ddbc1c8e0e7"
+dependencies = [
+ "bitflags 1.3.2",
+ "core-foundation",
+ "system-configuration-sys",
+]
+
+[[package]]
+name = "system-configuration-sys"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75fb188eb626b924683e3b95e3a48e63551fcfb51949de2f06a9d91dbee93c9"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "thiserror"
 version = "1.0.69"
@@ -2222,9 +2503,10 @@ dependencies = [
  "bytes",
  "libc",
  "mio",
+ "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
- "socket2",
+ "socket2 0.6.3",
  "tokio-macros",
  "windows-sys 0.61.2",
 ]
@@ -2240,13 +2522,35 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "tokio-rustls"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
+dependencies = [
+ "rustls 0.21.12",
+ "tokio",
+]
+
 [[package]]
 name = "tokio-rustls"
 version = "0.26.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
 dependencies = [
- "rustls",
+ "rustls 0.23.40",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-socks"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d4770b8024672c1101b3f6733eab95b18007dbe0847a8afe341fcf79e06043f"
+dependencies = [
+ "either",
+ "futures-util",
+ "thiserror 1.0.69",
  "tokio",
 ]
 
@@ -2281,7 +2585,7 @@ dependencies = [
  "futures-core",
  "futures-util",
  "pin-project-lite",
- "sync_wrapper",
+ "sync_wrapper 1.0.2",
  "tokio",
  "tower-layer",
  "tower-service",
@@ -2297,8 +2601,8 @@ dependencies = [
  "bitflags 2.11.1",
  "bytes",
  "futures-util",
- "http",
- "http-body",
+ "http 1.4.0",
+ "http-body 1.0.1",
  "pin-project-lite",
  "tower",
  "tower-layer",
@@ -2647,6 +2951,12 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "webpki-roots"
+version = "0.25.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f20c57d8d7db6d3b86154206ae5d8fba62dd39573114de97c2cb0578251f8e1"
+
 [[package]]
 name = "webpki-roots"
 version = "0.26.11"
@@ -2742,6 +3052,15 @@ dependencies = [
  "windows-targets 0.42.2",
 ]
 
+[[package]]
+name = "windows-sys"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
+dependencies = [
+ "windows-targets 0.48.5",
+]
+
 [[package]]
 name = "windows-sys"
 version = "0.52.0"
@@ -2775,6 +3094,21 @@ dependencies = [
  "windows_x86_64_msvc 0.42.2",
 ]
 
+[[package]]
+name = "windows-targets"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
+dependencies = [
+ "windows_aarch64_gnullvm 0.48.5",
+ "windows_aarch64_msvc 0.48.5",
+ "windows_i686_gnu 0.48.5",
+ "windows_i686_msvc 0.48.5",
+ "windows_x86_64_gnu 0.48.5",
+ "windows_x86_64_gnullvm 0.48.5",
+ "windows_x86_64_msvc 0.48.5",
+]
+
 [[package]]
 name = "windows-targets"
 version = "0.52.6"
@@ -2797,6 +3131,12 @@ version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
 
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
+
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.52.6"
@@ -2809,6 +3149,12 @@ version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
 
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
+
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.52.6"
@@ -2821,6 +3167,12 @@ version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
 
+[[package]]
+name = "windows_i686_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
+
 [[package]]
 name = "windows_i686_gnu"
 version = "0.52.6"
@@ -2839,6 +3191,12 @@ version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
 
+[[package]]
+name = "windows_i686_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
+
 [[package]]
 name = "windows_i686_msvc"
 version = "0.52.6"
@@ -2851,6 +3209,12 @@ version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
 
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
+
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.52.6"
@@ -2863,6 +3227,12 @@ version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
 
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
+
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.52.6"
@@ -2875,12 +3245,28 @@ version = "0.42.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
 
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
+
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
+[[package]]
+name = "winreg"
+version = "0.50.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "524e57b2c537c0f9b1e69f1965311ec12182b4122e45035b1508cd24d2adadb1"
+dependencies = [
+ "cfg-if",
+ "windows-sys 0.48.0",
+]
+
 [[package]]
 name = "winres"
 version = "0.1.12"
diff --git a/Cargo.toml b/Cargo.toml
index 9698650..a906bd8 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -5,7 +5,7 @@ members = [
     "ostp-server",
     "ostp-jni", "ostp",
     "ostp-tun-helper"
-]
+, "ostp-brain"]
 exclude = ["ostp-gui/src-tauri"]
 resolver = "2"
 
diff --git a/ostp-client/src/bridge.rs b/ostp-client/src/bridge.rs
index 330cc83..2b0e7ff 100644
--- a/ostp-client/src/bridge.rs
+++ b/ostp-client/src/bridge.rs
@@ -907,7 +907,7 @@ impl Bridge {
             // For UoT, use the stealth_port if it's configured and differs from default 443;
             // otherwise fall back to the actual server port so the user doesn't need two separate
             // port fields for the same destination.
-            let uot_port = if self.stealth_port != 443 {
+            let uot_port = if self.stealth_port > 0 {
                 self.stealth_port
             } else {
                 port
diff --git a/ostp-client/src/config.rs b/ostp-client/src/config.rs
index 8cb1f78..3bab864 100644
--- a/ostp-client/src/config.rs
+++ b/ostp-client/src/config.rs
@@ -58,7 +58,7 @@ pub struct OstpConfig {
 
 fn default_keepalive() -> u64 { 5 }
 
-fn default_mtu() -> usize { 1350 }
+fn default_mtu() -> usize { 1500 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct LocalProxyConfig {
diff --git a/ostp-client/src/runner.rs b/ostp-client/src/runner.rs
index eaff88e..fc85517 100644
--- a/ostp-client/src/runner.rs
+++ b/ostp-client/src/runner.rs
@@ -163,9 +163,7 @@ pub async fn run_client_core(
         .map_err(|e| anyhow::anyhow!("Failed to resolve server address {}: {}", config.ostp.server_addr, e))?
         .collect();
         
-    #[cfg(target_os = "android")]
-    resolved_addrs.sort_by_key(|addr| if addr.is_ipv6() { 0 } else { 1 });
-        
+
     let target_addr = resolved_addrs.first()
         .ok_or_else(|| anyhow::anyhow!("No IP addresses resolved for {}", config.ostp.server_addr))?;
         
diff --git a/ostp-client/src/transport/xhttp.rs b/ostp-client/src/transport/xhttp.rs
index ba9169b..c5b7514 100644
--- a/ostp-client/src/transport/xhttp.rs
+++ b/ostp-client/src/transport/xhttp.rs
@@ -29,16 +29,26 @@ pub async fn connect_xhttp(
     reality_sid: &str,
 ) -> Result<(mpsc::Sender<Bytes>, Arc<tokio::sync::Mutex<mpsc::Receiver<Bytes>>>)> {
     let addr = std::net::SocketAddr::new(target_ip, port);
-    let mut tcp_stream = TcpStream::connect(addr).await
+    
+    #[cfg(not(target_os = "android"))]
+    let mut tcp_stream = tokio::net::TcpStream::connect(addr).await
         .with_context(|| format!("failed to connect to {}", addr))?;
-    tcp_stream.set_nodelay(true)?;
 
     #[cfg(target_os = "android")]
-    {
+    let mut tcp_stream = {
+        let domain = if target_ip.is_ipv6() { socket2::Domain::IPV6 } else { socket2::Domain::IPV4 };
+        let sock = socket2::Socket::new(domain, socket2::Type::STREAM, Some(socket2::Protocol::TCP))?;
+        
         use std::os::unix::io::AsRawFd;
-        let fd = tcp_stream.as_raw_fd();
-        crate::bridge::invoke_socket_protector(fd);
-    }
+        crate::bridge::protect_socket(sock.as_raw_fd());
+        
+        sock.set_nonblocking(true)?;
+        let tcp_socket = tokio::net::TcpSocket::from_std_stream(sock.into());
+        tcp_socket.connect(addr).await
+            .with_context(|| format!("failed to connect to {}", addr))?
+    };
+
+    tcp_stream.set_nodelay(true)?;
 
     if reality_enabled {
         let pbk_bytes = base64::engine::general_purpose::URL_SAFE_NO_PAD.decode(reality_pbk)
diff --git a/ostp-client/src/tunnel/native_handler.rs b/ostp-client/src/tunnel/native_handler.rs
index 05fcb8b..da83ec2 100644
--- a/ostp-client/src/tunnel/native_handler.rs
+++ b/ostp-client/src/tunnel/native_handler.rs
@@ -120,6 +120,9 @@ pub async fn run_native_tunnel(
     }
 
     let (stack, tcp_runner, udp_socket, tcp_listener) = StackBuilder::default()
+        .stack_buffer_size(100000)
+        .tcp_buffer_size(100000)
+        .udp_buffer_size(100000)
         .enable_tcp(true)
         .enable_udp(true)
         .mtu(config.ostp.mtu)
@@ -273,17 +276,25 @@ pub async fn run_native_tunnel_from_fd(
         }
     }
 
-    let file = unsafe { std::fs::File::from_raw_fd(fd) };
+    let read_fd = unsafe { libc::dup(fd) };
+    if read_fd < 0 {
+        return Err(anyhow::anyhow!("Failed to dup tun fd for reading"));
+    }
+    
+    let file = unsafe { std::fs::File::from_raw_fd(read_fd) };
     let tun_stream = tokio::io::unix::AsyncFd::new(file)?;
 
     let (stack, tcp_runner, udp_socket, tcp_listener) = StackBuilder::default()
+        .stack_buffer_size(100000)
+        .tcp_buffer_size(100000)
+        .udp_buffer_size(100000)
         .enable_tcp(true)
         .enable_udp(true)
         .mtu(config.ostp.mtu)
         .build()?;
 
     let mut runner_task = tokio::spawn(async move {
-        if let Some(mut runner) = tcp_runner {
+        if let Some(runner) = tcp_runner {
             let _ = runner.await;
         }
     });
diff --git a/ostp-client/src/tunnel/proxy.rs b/ostp-client/src/tunnel/proxy.rs
index 207c45a..25df852 100644
--- a/ostp-client/src/tunnel/proxy.rs
+++ b/ostp-client/src/tunnel/proxy.rs
@@ -123,6 +123,7 @@ fn get_linux_physical_if_name() -> Option<String> {
     None
 }
 
+#[allow(unused_variables)]
 async fn connect_bypassing_tun(
     target: &str,
     physical_if_index: Option<u32>,
@@ -171,6 +172,7 @@ async fn connect_bypassing_tun(
     ))
 }
 
+#[allow(unused_variables)]
 async fn create_udp_socket_bypassing_tun(
     is_ipv6: bool,
     physical_if_index: Option<u32>,
diff --git a/ostp-client/src/tunnel/udp_nat.rs b/ostp-client/src/tunnel/udp_nat.rs
index 51d4ecf..87fdcdd 100644
--- a/ostp-client/src/tunnel/udp_nat.rs
+++ b/ostp-client/src/tunnel/udp_nat.rs
@@ -21,7 +21,7 @@ pub async fn run_udp_nat(
         if payload.is_empty() { continue; }
 
         if !sessions.contains_key(&src) {
-            let (session_tx, mut session_rx) = mpsc::channel::<(Vec<u8>, SocketAddr)>(128);
+            let (session_tx, mut session_rx) = mpsc::channel::<(Vec<u8>, SocketAddr)>(100000);
             sessions.insert(src, session_tx);
 
             let proxy_addr_clone = proxy_addr.clone();
diff --git a/ostp-flutter/android/app/src/main/kotlin/com/ospab/ostp_client/OstpVpnService.kt b/ostp-flutter/android/app/src/main/kotlin/com/ospab/ostp_client/OstpVpnService.kt
index 525f3a6..ae0c36e 100644
--- a/ostp-flutter/android/app/src/main/kotlin/com/ospab/ostp_client/OstpVpnService.kt
+++ b/ostp-flutter/android/app/src/main/kotlin/com/ospab/ostp_client/OstpVpnService.kt
@@ -35,7 +35,10 @@ class OstpVpnService : VpnService() {
         @Keep
         @JvmStatic
         fun protectSocket(fd: Int): Boolean {
-            return instance?.protect(fd) ?: false
+            // App is excluded from VPN via addDisallowedApplication/addAllowedApplication.
+            // VpnService.protect() bypasses clatd (464XLAT) on IPv6-only mobile networks,
+            // breaking IPv4 connectivity. Since we're excluded, protect() is unnecessary.
+            return true
         }
 
         /**
diff --git a/ostp-flutter/lib/main.dart b/ostp-flutter/lib/main.dart
index 4631853..c6512ac 100644
--- a/ostp-flutter/lib/main.dart
+++ b/ostp-flutter/lib/main.dart
@@ -340,6 +340,97 @@ class _HomeScreenState extends State<HomeScreen> with TickerProviderStateMixin {
     }
   }
 
+  Future<void> _runAutoMode() async {
+    final mtus = [1500, 1350, 1280];
+    final modes = [
+      {'t': 'udp', 'w': false, 'r': false},
+      {'t': 'uot', 'w': false, 'r': false},
+      {'t': 'uot', 'w': true,  'r': false},
+      {'t': 'uot', 'w': false, 'r': true},
+    ];
+
+    if (_serverAddr.isEmpty || _accessKey.isEmpty) {
+      ScaffoldMessenger.of(context).showSnackBar(
+        const SnackBar(content: Text('Please configure Server and Key first')),
+      );
+      return;
+    }
+
+    for (var mode in modes) {
+      for (var mtu in mtus) {
+        if (!mounted) return;
+        ScaffoldMessenger.of(context).showSnackBar(
+          SnackBar(content: Text('Testing: ${mode['t']} | WSS: ${mode['w']} | XTLS: ${mode['r']} | MTU: $mtu'), duration: const Duration(seconds: 2)),
+        );
+
+        // Update prefs
+        await widget.prefs.setString('mtu', mtu.toString());
+        await widget.prefs.setString('transport_mode', mode['t'] as String);
+        await widget.prefs.setBool('wss', mode['w'] as bool);
+        await widget.prefs.setBool('reality_enabled', mode['r'] as bool);
+        _updateLatestConfigJson();
+
+        setState(() {
+          _state = ConnectionStateEnum.connecting;
+        });
+        _pulseController.repeat(reverse: true);
+        _spinController.repeat();
+
+        try {
+          final configJson = widget.prefs.getString('latest_config_json') ?? '{}';
+          await platform.invokeMethod('startTunnel', {"configJson": configJson});
+
+          bool started = false;
+          for (int i = 0; i < 10; i++) {
+            await Future.delayed(const Duration(milliseconds: 500));
+            final isRunning = await platform.invokeMethod('isRunning');
+            if (isRunning == true) {
+              started = true;
+              break;
+            }
+          }
+
+          if (started) {
+            _setConnected();
+            // Wait to see if connection is stable and ping is successful
+            await Future.delayed(const Duration(seconds: 3));
+            try {
+              final metricsJson = await platform.invokeMethod('getMetrics');
+              if (metricsJson != null && metricsJson.isNotEmpty) {
+                final Map<String, dynamic> parsed = jsonDecode(metricsJson);
+                final rttMs = parsed['rtt_ms'] as int? ?? 0;
+                if (rttMs > 0) {
+                  if (mounted) {
+                    ScaffoldMessenger.of(context).showSnackBar(
+                      SnackBar(content: Text('Success! Found working config: ${mode['t']} (MTU $mtu)')),
+                    );
+                  }
+                  return; // Stop on first working config
+                }
+              }
+            } catch (e) {
+              // Ignore metrics error
+            }
+
+            // Connection seems unstable or no ping, stop and try next
+            await platform.invokeMethod('stopTunnel');
+            _setDisconnected();
+          } else {
+            _setDisconnected();
+          }
+        } catch (e) {
+          _setDisconnected();
+        }
+      }
+    }
+
+    if (mounted) {
+      ScaffoldMessenger.of(context).showSnackBar(
+        const SnackBar(content: Text('Auto search finished. No working config found.')),
+      );
+    }
+  }
+
   void _setConnected() {
     if (!mounted) return;
     setState(() {
@@ -558,16 +649,33 @@ class _HomeScreenState extends State<HomeScreen> with TickerProviderStateMixin {
               ),
             ],
           ),
-          IconButton(
-            iconSize: 30,
-            icon: const Icon(Icons.settings_outlined, color: Colors.white),
-            onPressed: () async {
-              await Navigator.push(
-                context,
-                MaterialPageRoute(builder: (context) => SettingsScreen(prefs: widget.prefs)),
-              );
-              _loadSettings();
-            },
+          Row(
+            children: [
+              IconButton(
+                iconSize: 30,
+                icon: const Icon(Icons.auto_mode_rounded, color: Colors.white),
+                onPressed: () {
+                  if (_state != ConnectionStateEnum.disconnected) {
+                    ScaffoldMessenger.of(context).showSnackBar(
+                      const SnackBar(content: Text('Disconnect first to run Auto mode')),
+                    );
+                    return;
+                  }
+                  _runAutoMode();
+                },
+              ),
+              IconButton(
+                iconSize: 30,
+                icon: const Icon(Icons.settings_outlined, color: Colors.white),
+                onPressed: () async {
+                  await Navigator.push(
+                    context,
+                    MaterialPageRoute(builder: (context) => SettingsScreen(prefs: widget.prefs)),
+                  );
+                  _loadSettings();
+                },
+              )
+            ],
           )
         ],
       ),
diff --git a/ostp-flutter/ostp-client-release.apk b/ostp-flutter/ostp-client-release.apk
index fce89c4..5ce1de0 100644
Binary files a/ostp-flutter/ostp-client-release.apk and b/ostp-flutter/ostp-client-release.apk differ
diff --git a/ostp-gui/src-tauri/Cargo.lock b/ostp-gui/src-tauri/Cargo.lock
index 96c8239..a62fe15 100644
--- a/ostp-gui/src-tauri/Cargo.lock
+++ b/ostp-gui/src-tauri/Cargo.lock
@@ -2641,7 +2641,7 @@ dependencies = [
 
 [[package]]
 name = "ostp-client"
-version = "0.2.71"
+version = "0.2.73"
 dependencies = [
  "anyhow",
  "base64 0.22.1",
@@ -2671,7 +2671,7 @@ dependencies = [
 
 [[package]]
 name = "ostp-core"
-version = "0.2.71"
+version = "0.2.73"
 dependencies = [
  "anyhow",
  "bytes",
diff --git a/ostp-gui/src/index.html b/ostp-gui/src/index.html
index 718c817..808a3e1 100644
--- a/ostp-gui/src/index.html
+++ b/ostp-gui/src/index.html
@@ -28,6 +28,11 @@
           <span class="brand-name">OSTP</span>
         </div>
         <div class="topbar-right">
+          <button id="btn-auto-connect" class="icon-btn" aria-label="Auto">
+            <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+              <path d="M12 2v4M12 18v4M4.93 4.93l2.83 2.83M16.24 16.24l2.83 2.83M2 12h4M18 12h4M4.93 19.07l2.83-2.83M16.24 7.76l2.83-2.83"/>
+            </svg>
+          </button>
           <button id="btn-go-settings" class="icon-btn" aria-label="Settings">
             <!-- Gear icon -->
             <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
diff --git a/ostp-gui/src/main.js b/ostp-gui/src/main.js
index 47fc5b3..c236ee7 100644
--- a/ostp-gui/src/main.js
+++ b/ostp-gui/src/main.js
@@ -33,6 +33,7 @@ const btnTestPing    = $('btn-test-ping');
 const toast          = $('toast');
 
 const btnGoSettings  = $('btn-go-settings');
+const btnAutoConnect = $('btn-auto-connect');
 const btnBack        = $('btn-back');
 const btnImport      = $('btn-import-url');
 const btnPeekKey     = $('btn-peek-key');
@@ -398,6 +399,73 @@ window.addEventListener('DOMContentLoaded', async () => {
   }
 
   btnConnect.addEventListener('click',       handleToggle);
+  
+  if (btnAutoConnect) {
+    btnAutoConnect.addEventListener('click', async () => {
+      if (appState !== 'disconnected') {
+        showToast('Disconnect first to run Auto mode', 'error');
+        return;
+      }
+      
+      try {
+        const raw = await invoke('get_config');
+        rawConfig = JSON.parse(raw);
+      } catch {
+        showToast('Please save your config first', 'error');
+        return;
+      }
+
+      showToast('Starting Auto search...', 'ok');
+      const mtus = [1500, 1350, 1280];
+      const modes = [
+        { t: 'udp', w: false, r: false },
+        { t: 'uot', w: false, r: false },
+        { t: 'uot', w: true, r: false },
+        { t: 'uot', w: false, r: true }
+      ];
+
+      for (let mode of modes) {
+        for (let mtu of mtus) {
+          showToast(`Testing: ${mode.t} | WSS: ${mode.w} | XTLS: ${mode.r} | MTU: ${mtu}`);
+          
+          rawConfig.mtu = mtu;
+          rawConfig.transport = rawConfig.transport || {};
+          rawConfig.transport.mode = mode.t;
+          rawConfig.transport.wss = mode.w;
+          
+          if (mode.r) {
+            rawConfig.reality = rawConfig.reality || {};
+            rawConfig.reality.enabled = true;
+          } else if (rawConfig.reality) {
+            rawConfig.reality.enabled = false;
+          }
+
+          await invoke('save_config', { jsonContent: JSON.stringify(rawConfig, null, 2) });
+          
+          setState('connecting');
+          const ok = await invoke('start_tunnel');
+          if (ok) {
+            startPolling();
+            // Wait a bit to see if it stays connected and ping works
+            await new Promise(r => setTimeout(r, 3000));
+            try {
+              const metrics = await invoke('get_metrics');
+              if (metrics && metrics.rtt_ms > 0) {
+                showToast(`Success! Found working config: ${mode.t} (MTU ${mtu})`, 'ok');
+                return; // Stop on first working
+              }
+            } catch {}
+            
+            // If we are here, ping failed, so stop and try next
+            await invoke('stop_tunnel');
+            setState('disconnected');
+          }
+        }
+      }
+      showToast('Auto search finished. No working config found.', 'error');
+    });
+  }
+
   btnGoSettings.addEventListener('click',    () => showScreen('settings'));
   btnBack.addEventListener('click',          () => showScreen('home'));
   btnImport.addEventListener('click',        handleImport);
diff --git a/ostp-server/src/transport/uot.rs b/ostp-server/src/transport/uot.rs
index 5275cbc..1261f81 100644
--- a/ostp-server/src/transport/uot.rs
+++ b/ostp-server/src/transport/uot.rs
@@ -41,8 +41,23 @@ where
     }
     header_len += n;
 
-    // Check if it's a TLS record (0x16 0x03 0x01)
-    if initial_buf[0] == 0x16 && initial_buf[1] == 0x03 && initial_buf[2] == 0x01 {
+    // Check if it's a TLS record (0x16 0x03 0x01 or 0x16 0x03 0x03)
+    if initial_buf[0] == 0x16 && initial_buf[1] == 0x03 {
+        // It's a TLS record. We need to ensure we read the entire record.
+        if header_len >= 5 {
+            let record_len = 5 + u16::from_be_bytes([initial_buf[3], initial_buf[4]]) as usize;
+            if record_len > initial_buf.len() {
+                anyhow::bail!("TLS record too large");
+            }
+            while header_len < record_len {
+                let n = stream.read(&mut initial_buf[header_len..record_len]).await?;
+                if n == 0 {
+                    anyhow::bail!("connection closed while reading TLS record");
+                }
+                header_len += n;
+            }
+        }
+        
         if let Some(rc) = reality_config {
             return handle_reality_connection(stream, initial_buf[..header_len].to_vec(), peer_addr, shared_keys, udp_tx, tcp_map, rc).await;
         } else {