Metadata-Version: 2.4
Name: brahma-edge
Version: 0.1.0
Summary: Read-only edge daemon that connects a client's local acoustic repo to IDent Dynamics (no audio leaves the box).
Author-email: Vixen Intelligence <ident@vixenintelligence.com>
Maintainer-email: Vixen Intelligence <ident@vixenintelligence.com>
License: Apache-2.0
Project-URL: Homepage, https://github.com/energy-master/brahma_edge
Project-URL: Repository, https://github.com/energy-master/brahma_edge
Project-URL: Issues, https://github.com/energy-master/brahma_edge/issues
Project-URL: IDent Dynamics, https://www.goident.ai
Keywords: acoustics,edge,ident-dynamics,streaming,reverse-tunnel,daemon
Classifier: Development Status :: 4 - Beta
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Intended Audience :: Science/Research
Classifier: Operating System :: POSIX :: Linux
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.7
Classifier: Programming Language :: Python :: 3.8
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Topic :: Multimedia :: Sound/Audio :: Analysis
Classifier: Topic :: Internet :: WWW/HTTP :: HTTP Servers
Requires-Python: >=3.7
Description-Content-Type: text/markdown
License-File: LICENSE
Provides-Extra: audio
Requires-Dist: soundfile>=0.12; extra == "audio"
Dynamic: license-file

# Vixen Intelligence | IDent Dynamics

# brahma-edge

A small, **read-only** edge daemon that connects a client's *local* acoustic data repository to
[IDent Dynamics](https://www.goident.ai) allowing recordings to be browsed, streamed, and searched from
IDent Dynamics **without the audio ever leaving the client's server**.



- **Pure Python standard library** (Python ≥ 3.7 — runs on 3.7.5). `soundfile` is an *optional* extra, used only for
  richer per-folder metadata (duration / sample-rate / channels).
- **No database, no model code, no write surface** — every non-read route returns 404.
- Apache-2.0 licensed.

## Security

- The daemon is **read-only**. There is no path that writes, deletes, or executes.
- Bearer-token auth on every route but `/healthz`. 
- Path traversal is blocked by an allow-list on names plus a realpath sandbox to the repo root.
- The reverse-tunnel key on the central host should be locked down with
  `no-pty,no-agent-forwarding,no-X11-forwarding,permitlisten="127.0.0.1:<port>"` (see
  [CONNECTING.md](CONNECTING.md) step 0.5)
- `permitlisten` for the `-R` forward, no shell, and a
  `Match User tunnel → AllowTcpForwarding remote` block to block `-L`. 
- Contact ident@vixenintelligence.com for more security information.
