mediad: answer one raw frame on a local socket (media.frame)

.github/workflows/_build-release.yml

@@ -168,14 +168,14 @@ jobs:
             --include "robotd/systemd/robotd.service=systemd/robotd.service" \
             --include "hooks/postinstall=hooks/postinstall" \
             --include "scripts/setup-gstreamer.sh=scripts/setup-gstreamer.sh" \
-            --include "duck-detect/models/duck_detect.rknn=models/duck_detect.rknn" \
-            --include "duck-detect/models/duck_detect.onnx=models/duck_detect.onnx" \
             --include "scripts/setup-npu.sh=scripts/setup-npu.sh" \
             --include "deploy/overlays/rk3568-npu-enable.dts=deploy/overlays/rk3568-npu-enable.dts" \
             --include "scripts/setup-rkaiq.sh=scripts/setup-rkaiq.sh" \
             --include "scripts/rkaiq-modinfo-shim.c=scripts/rkaiq-modinfo-shim.c" \
             --include "scripts/setup-login.sh=scripts/setup-login.sh" \
+            --include "scripts/setup-quiet-boot.sh=scripts/setup-quiet-boot.sh" \
             --include "scripts/seed-policies.sh=scripts/seed-policies.sh" \
+            --include "scripts/seed-detector.sh=scripts/seed-detector.sh" \
             --include "scripts/robot-rescue=scripts/robot-rescue" \
             --include "scripts/robot-boot-check=scripts/robot-boot-check" \
             --include "updater/systemd/robot-boot-check.service=systemd/robot-boot-check.service" \

.github/workflows/ci.yml

@@ -102,7 +102,7 @@ jobs:
       # a bashism would work on a dev box and fail on the board.
       - name: Lint the installer
         run: |
-          for script in scripts/install.sh scripts/setup-board.sh scripts/setup-gstreamer.sh scripts/setup-login.sh scripts/migrate-network.sh scripts/provision.sh scripts/provision-board.sh scripts/ci-release-notes.sh scripts/robot-rescue scripts/dev-push.sh scripts/pad-link-test.sh scripts/pad-stack-report.sh scripts/seed-policies.sh; do
+          for script in scripts/install.sh scripts/setup-board.sh scripts/setup-gstreamer.sh scripts/setup-login.sh scripts/setup-quiet-boot.sh scripts/migrate-network.sh scripts/provision.sh scripts/provision-board.sh scripts/ci-release-notes.sh scripts/robot-rescue scripts/dev-push.sh scripts/pad-link-test.sh scripts/pad-stack-report.sh scripts/seed-policies.sh scripts/seed-detector.sh; do
             sh -n "$script"
             shellcheck --shell=sh "$script"
             # The one-liner is only correct if the file is executable and self-contained.

.github/workflows/dev.yml

@@ -154,14 +154,14 @@ jobs:
             --include "robotd/systemd/robotd.service=systemd/robotd.service" \
             --include "hooks/postinstall=hooks/postinstall" \
             --include "scripts/setup-gstreamer.sh=scripts/setup-gstreamer.sh" \
-            --include "duck-detect/models/duck_detect.rknn=models/duck_detect.rknn" \
-            --include "duck-detect/models/duck_detect.onnx=models/duck_detect.onnx" \
             --include "scripts/setup-npu.sh=scripts/setup-npu.sh" \
             --include "deploy/overlays/rk3568-npu-enable.dts=deploy/overlays/rk3568-npu-enable.dts" \
             --include "scripts/setup-rkaiq.sh=scripts/setup-rkaiq.sh" \
             --include "scripts/rkaiq-modinfo-shim.c=scripts/rkaiq-modinfo-shim.c" \
             --include "scripts/setup-login.sh=scripts/setup-login.sh" \
+            --include "scripts/setup-quiet-boot.sh=scripts/setup-quiet-boot.sh" \
             --include "scripts/seed-policies.sh=scripts/seed-policies.sh" \
+            --include "scripts/seed-detector.sh=scripts/seed-detector.sh" \
             --include "scripts/robot-rescue=scripts/robot-rescue" \
             --include "scripts/robot-boot-check=scripts/robot-boot-check" \
             --include "updater/systemd/robot-boot-check.service=systemd/robot-boot-check.service" \

.github/workflows/turn-endpoint.yml

@@ -0,0 +1,77 @@
+# Does the relay credentials endpoint still answer?
+#
+# `mediad::turn` fetches short-lived Cloudflare credentials so a robot can offer a `relay`
+# candidate to a consumer that cannot reach it directly. The endpoint it used before
+# 2026-09 had been dead since June — a dangling Route53 delegation — and **nothing
+# noticed for three months**, because the only symptom is a warning in a journal nobody
+# reads and a candidate type nobody counts. Every other check in this repository passes
+# regardless: they pair two peers on one network, which never looks at a relay.
+#
+# So this is the one check that would have caught it, and it is deliberately *not* on
+# `pull_request`. The failure being guarded against is "nobody touched this for months",
+# which a PR trigger cannot see; and a third party's outage must never block work that has
+# nothing to do with it. A scheduled failure mails whoever owns the repository, which is
+# the right blast radius for "an upstream service went away".
+name: turn-endpoint
+
+on:
+  schedule:
+    # Daily. The endpoint is somebody else's Space, and a week of relay coverage lost
+    # before anybody hears about it is most of the damage already done.
+    - cron: "41 5 * * *"
+  workflow_dispatch:
+
+jobs:
+  credentials:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      # **Read the URL out of the source rather than repeating it here.** A check with its
+      # own copy of the endpoint tests whatever it was last told, which can drift from what
+      # the daemon compiles in — and a green check on an endpoint no robot uses is worse
+      # than no check, because it reads as proof.
+      - name: Ask the endpoint the daemon uses
+        env:
+          HF_TOKEN: ${{ secrets.HF_TOKEN }}
+        run: |
+          set -euo pipefail
+
+          url=$(sed -n 's/^pub const DEFAULT_TURN_ENDPOINT: &str = "\(.*\)";$/\1/p' \
+              mediad/src/turn.rs)
+          [ -n "$url" ] || {
+              echo "::error::could not read DEFAULT_TURN_ENDPOINT from mediad/src/turn.rs"
+              exit 1
+          }
+          echo "endpoint: $url"
+
+          # No token means this cannot check anything. Failing is the point: a check that
+          # skips itself into permanent silence is the failure mode this workflow exists
+          # to end.
+          [ -n "${HF_TOKEN:-}" ] || {
+              echo "::error::no HF_TOKEN secret. Add a Hugging Face token with no scopes" \
+                   "beyond sign-in; it is used only to mint TURN credentials."
+              exit 1
+          }
+
+          code=$(curl -sS -o body.json -w '%{http_code}' --max-time 30 \
+              -H "Authorization: Bearer $HF_TOKEN" "$url?ttl=600")
+          [ "$code" = "200" ] || {
+              echo "::error::$url answered HTTP $code, not 200"
+              head -c 400 body.json || true
+              exit 1
+          }
+
+          # A 200 carrying no relay is still a robot with no relay candidate to offer —
+          # which is the outage, not a milder version of it. `stun:` entries do not count:
+          # `webrtcbin` takes a STUN server through its own property, and this is about the
+          # thing STUN cannot do.
+          relays=$(jq '[.iceServers[]? | .urls] | flatten
+                       | map(select(startswith("turn:") or startswith("turns:")))
+                       | length' body.json)
+          echo "relay servers offered: $relays"
+          [ "$relays" -gt 0 ] || {
+              echo "::error::$url answered 200 with no turn:/turns: entries"
+              head -c 400 body.json || true
+              exit 1
+          }

.gitignore

@@ -20,3 +20,11 @@ secret*
 
 # Playground and scratch state (see updater/examples/playground.rs).
 /verify
+
+# Python bytecode from the demo Space, which is source rather than a build here.
+__pycache__/
+
+# A venv beside a Space's source, for running one locally. `uv venv` writes its own `.gitignore`
+# holding `*` so it self-ignores; this is for the person who reaches for `python -m venv`, which
+# does not, and it is the same accident `__pycache__` above was added for.
+.venv/

AGENTS.md

@@ -0,0 +1,41 @@
+# Working in this repository
+
+`CONTRIBUTING.md` is the reference: building, testing, layout, conventions, releasing. This page
+is the short list of things that are easy to get backwards, and where the answer lives when they
+are not here.
+
+## Docs own mechanisms; one page each
+
+`docs/README.md` assigns every mechanism to one design doc. When a fact belongs to a page listed
+there, every other page says one sentence and links. When two pages disagree, the one that does
+not own the mechanism is the bug — and when behaviour and a design doc disagree, the doc is the
+bug. [`docs/faq.md`](docs/faq.md) is the task-shaped front door for someone building against a
+robot rather than changing it.
+
+## A consumer uses WebRTC. `media.stream` is the fallback
+
+The robot publishes H.264 over WebRTC, and that is the default for anything consuming a duck's
+camera — it is encrypted end to end, it carries the control channel on the same session, and it
+has a return path. It works from a data centre because the robot offers a relay candidate
+(`remote-access-design.md` §6).
+
+`media.stream` — the robot dialling an outbound WebSocket and pushing frames to you — is the
+fallback for a **program** consuming **frames only** on a **long-running** stream, where relay
+metering is the thing that matters. It has no return path and no control channel.
+
+This is worth stating because the repository reads the other way round if you only follow the
+code: `media.stream` was built when the relay endpoint was dead and WebRTC genuinely could not
+connect from a data centre, so its module doc argues its own case at length. That endpoint is
+fixed. Do not conclude from the volume of prose that it is the preferred path.
+
+## Never design around a version difference
+
+One user, one robot. An old component's limits are a question to raise, not something to route
+around — bump `API_VERSION` and name the install consequence. A version skew is logged and served,
+never refused; only a genuinely missing route or an unknown parameter may refuse.
+
+## Releases are how a fix reaches a robot
+
+`main` being fixed is not a robot being fixed. Robots on the stable channel move when a release is
+cut, and a dev build from a branch is superseded by the next `daemon-dev-main` the board's
+six-hourly check finds. `docs/design/updater-design.md` owns the mechanism.

CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md

CONTRIBUTING.md

@@ -100,6 +100,7 @@ hooks/          preinstall · postinstall — what runs inside an update, from t
 scripts/        provision-board.sh · dev-push.sh + dev-build.Dockerfile (from your machine) ·
                 provision.sh → setup-board.sh → setup-gstreamer.sh · setup-rkaiq.sh ·
                 migrate-network.sh · install.sh (on the board) ·
+                setup-login.sh · setup-quiet-boot.sh (install.sh and postinstall both run these) ·
                 robot-boot-check · robot-rescue (recovery, installed to /usr/local/sbin) ·
                 pad-link-test.sh · pad-stack-report.sh (gamepad radio, on the board) ·
                 board-test.sh · systemd-test.sh (CI) · cross-sysroot.sh (cross-builds) ·