Files

B.D. Murphy 0c9bea72e0 Add enterprise/infra tooling and repoint Qwen3-TTS submodule to internal fork

Two groups of changes, committed together as the follow-up to the initial push:

1. .gitmodules — submodule Qwen3-TTS now points at the internal Gitea fork
   (ssh://git@mini-eq:2222/umbragit/Qwen3-TTS.git) instead of upstream GitHub,
   so a clone actually gets the UmbraAudio branding/integration commit
   012e452 rather than vanilla upstream.

2. New infra/ tooling for the cross-machine work in spec 21: agent_bridge,
   remote_credential_broker (Keychain-backed, secrets read at runtime and
   generated via read_secret/random_secret — no hardcoded credentials), the
   enterprise bootstrap scripts, and the oldbox SSH/auth prompts. Plus
   backup/ restore scripts, two specs (18 UmbraTrans, 19 enterprise control
   plane), umbraaudio/voices/lmstudio_gate.py, and in-flight edits to the
   discovery/attribution/profiling modules, config, chapter_builder, emotion,
   pronunciation, qwen_tts and routes.

Also adds *.db to .gitignore: SQLite project databases are runtime state and no
.db file was tracked before.

Verified before staging: .env's only change is UMBRA_TTS__QWEN_TTS_HELPER_URL and
the committed copy has zero secret-looking values; the broker ships only
config.example.json.

2026-10-06 06:57:41 -07:00

1.9 KiB

Raw Blame History

Temporary UmbraTrans agent bridge

This is a one-hour, LAN-only browser pairing point for communication between the Mac agent and a browser session on oldbox. It is not a remote shell.

Properties

Random OS-assigned TCP port.
HTTPS with a temporary self-signed certificate.
One-hour hard expiry.
Password is entered once in a native Mac setup dialog and once in the browser on the other machine.
Password is hashed in memory; plaintext is not logged or written to disk.
HttpOnly/Secure/SameSite session cookie and CSRF token.
No raw shell, no arbitrary command execution, no attachments.
Messages are atomic, bounded JSON files in a private queue.

The browser terminal is an agent message channel. The Mac agent must poll the inbox and send replies through the local bridge tooling; commands are not executed automatically from browser text.

Start

The listener runs on the Mac's LAN address. The startup dialog asks for the one-hour pairing password. The process prints the exact URL and port.

Example:

PYTHONPATH=/Volumes/1TB_APL_Storage/UmbraAudio/infra \
/usr/bin/python3 -m agent_bridge \
  --host 192.168.123.12 \
  --ttl 3600

Open the printed https://192.168.123.12:<port>/ URL in a browser on oldbox. Accept the temporary certificate warning if the browser requires it, then pair with the same one-hour password.

Queue

The default queue is:

~/.local/state/umbratrans/agent-bridge/
  inbox/       # browser messages waiting for the Mac agent
  outbox/      # Mac-agent replies waiting for the browser
  processed/   # browser messages already read
  delivered/   # browser replies acknowledged by the browser

All files are mode 0600; directories are mode 0700.

Safety

Do not expose the listener to the public internet.
Keep the one-hour timer unchanged.
Do not put passwords or private keys in messages.
Stop the process after the session if the automatic timer is interrupted.

1.9 KiB Raw Blame History