AMR codecs, proxy interop, and the 0.3.7 catch-up for 0.3.8 (#181)

Brings feat/amr-codecs up to the released 0.3.7 base and takes the two
commits ahead of it, so 0.3.8 can be cut from main.

Includes 023c064 (RFC 3261 12.1.1 secure fallback Contact, refs #176)
and 34b7310 (observation-only coordinator on the profiled egress
registration, for Bridgefu security evidence), plus two defects that
existed only in the merged tree: the opus passthrough bypass defeated by
per-leg payload numbering, and a barge-in flush that missed the AMR
re-framer.

PR Gate is green across 35 checks. CodeQL is red and was reviewed rather
than waved through: by stable alert identity main carries 697 open
alerts and this branch 703. Of the 11 in the delta, four are main's own
unchanged lines that were renumbered when the Kamailio and OpenSIPS
provider blocks were inserted above them, one is in a workflow file
byte-identical to main, four are false positives (an IP literal, two
SRTP boolean flags, and a println of tone and SNR figures), and two are
the accept-all proxy lab's default password, which the registrar never
challenges for. No new security defect.

Verified before merge: workspace check --all-targets --locked, the
full --all-features test run, the perf target under --release, and the
Kamailio proxy matrix at 32/32 -- registration, basic call, and AMR
NB/WB in both octet-aligned and bandwidth-efficient modes over UDP and
TLS, through a record-routing proxy with rtpengine. Bridgefu 53ef1c7
compiles against this tree with the workspace patched over its =0.3.7
pins.

Author: eisenzopf

.github/workflows/main-ci.yml

@@ -48,6 +48,10 @@ jobs:
             --job-mode combined
             --deferred-sip-mode separate
             --github-output "$GITHUB_OUTPUT"
+            --specialty-gate codec-features-codec-core
+            --specialty-gate codec-features-media-core
+            --specialty-gate codec-features-sip
+            --specialty-gate codec-features-core
             --specialty-gate release-tooling
             --specialty-gate rtp-interop
             --specialty-gate vcon-postgres

.gitignore

@@ -168,3 +168,22 @@ config.stamp
 
 ## CCD session state — never publish.
 .claude/
+
+## PBX interop labs
+# Local env: machine-specific addresses and credentials. The committed
+# *.env.example files are the templates; a real env/<provider>.env is sourced
+# after the lab-generated ~/Developer/<provider>/*-local.env and therefore
+# OVERRIDES it, so committing one silently redirects the release runners at a
+# developer's own lab addresses.
+crates/sip/rvoip-sip/examples/pbx/env/*.env
+!crates/sip/rvoip-sip/examples/pbx/env/*.env.example
+# Run artifacts: logs, WAVs, pcaps, matrix.tsv and per-role metadata, all
+# regenerated by every ./run.sh. Nothing reads the committed copy — the
+# release gates write their evidence to PBX_OUT_ROOT (the artifact dir)
+# instead — and the files embed absolute paths from whichever machine
+# produced them, so committing them adds churn and leaks local layout.
+crates/sip/rvoip-sip/examples/pbx/output/
+# Proxy lab configs rendered by up.sh from the .in templates, with the run's
+# public host, ports and a freshly generated TLS key beside them. Regenerated
+# every bring-up and machine-specific; the templates are what is tracked.
+infra/release-runners/pbx/*/.rendered/

CONTRIBUTING.md

@@ -28,6 +28,13 @@ qualification instead of holding every SIP PR open. Changes to shared or
 unmapped build inputs deliberately select the full workspace, while CI-policy-
 only changes run the planner and policy tests.
 
+Shards build each crate with its *default* features, so a test that lives
+behind an optional feature is compiled out rather than run. Where a crate keeps
+substantial test code behind such a feature — the codecs do, since G.729, Opus
+and AMR are all optional — a specialty gate repeats the run with
+`--all-features`. If you add an optional feature that carries tests, put it
+behind a gate; otherwise the tests exist and nothing executes them.
+
 ## Pull request expectations
 
 Complete the pull request template, including:

README.md

@@ -55,25 +55,29 @@ them.
 
 - **Beta-qualified** — covered by the SIP release gate and its bounded
   interoperability, security, standards, performance, and soak evidence.
-- **Available — developer preview** — implemented and included in `0.3.2`,
-  but API-unstable or outside the SIP beta attestation.
+- **Available — developer preview** — implemented and available in the
+  workspace, but API-unstable or outside the SIP beta attestation.
 - **Planned** — not implemented; listed only in the [roadmap](#roadmap).
 
 ## SIP interoperability
 
 The 0.3.2 full release run passed all 16 selected PBX and interoperability
-gates. The table distinguishes peers that were actually exercised from proxy
-targets that were only audited and deliberately excluded from the release
-claim.
+gates. The table distinguishes peers that were exercised by that release run
+from proxy targets that it audited and deliberately excluded.
 
-| Peer/tool | 0.3.2 status | Executed scope |
+Both proxies have since been exercised in the AMR interop lab. That is lab
+evidence, labelled as such: it does not join the 0.3.2 release claim, and it
+does not meet the four-peer attestation boundary described
+[below](#sip-interoperability-attestation).
+
+| Peer/tool | Status | Executed scope |
 | --- | --- | --- |
-| **Asterisk** | **Interop matrix passed** | `Endpoint`, `StreamPeer`, and `CallbackPeer`; registration, basic call, G.729A/G.729AB, hold/resume, ring-cancel, RFC 4733 DTMF, rejection, and blind transfer over UDP and TLS |
-| **FreeSWITCH** | **Interop matrix passed** | The same API, scenario, codec, and UDP/TLS matrix as Asterisk |
-| **SIPp** | **Standalone matrix passed** | 30, 100, 300, 1,000, and 2,000 CPS; every configured call completed |
-| **baresip** | **Strict-UA check passed** | External user-agent call against the rvoip SIP listener |
-| **Kamailio** | **Not release-tested** | Named proxy/RTPengine investigation track; the 0.3.2 gate records a de-scope audit, not a Kamailio interoperability claim |
-| **OpenSIPS** | **Not release-tested** | Named proxy/RTPengine investigation track; the 0.3.2 gate records a de-scope audit, not an OpenSIPS interoperability claim |
+| **Asterisk** | **0.3.2 interop matrix passed** | `Endpoint`, `StreamPeer`, and `CallbackPeer`; registration, basic call, G.729A/G.729AB, hold/resume, ring-cancel, RFC 4733 DTMF, rejection, and blind transfer over UDP and TLS |
+| **FreeSWITCH** | **0.3.2 interop matrix passed** | The same API, scenario, codec, and UDP/TLS matrix as Asterisk |
+| **SIPp** | **0.3.2 standalone matrix passed** | 30, 100, 300, 1,000, and 2,000 CPS; every configured call completed |
+| **baresip** | **0.3.2 strict-UA check passed** | External user-agent call against the rvoip SIP listener |
+| **Kamailio** | **Lab-tested; not release-gated** | Registrar-proxy with an rtpengine media relay: registration, calls, AMR in all four framings relayed verbatim, DTMF, and SDES-SRTP, over UDP and TLS. No TCP, no second adjacency order, and not bound into the release attestation |
+| **OpenSIPS** | **Lab-tested; not release-gated** | The same lab scope over UDP only — no TLS image yet |
 
 See the [0.3.2 complete gate
 record](crates/sip/rvoip-sip/docs/BETA_GATE_EXCEPTION.md) and
@@ -198,6 +202,7 @@ voice AI, and cross-transport integrations:
 | RTP/RTCP and G.711 | **Beta-qualified** | PCMU/PCMA media delivery, RTCP receiver reports, telephone-event DTMF, hold/resume, and bridging | [`rvoip-media-core`](crates/media/media-core) |
 | SDES-SRTP | **Beta-qualified** | Tested AES-CM/HMAC profiles with negotiated encrypted media | [`07-secure-call-srtp`](examples/07-secure-call-srtp) |
 | G.729A/G.729AB | **Available — developer preview** | Fully integrated optional path: PT 18 SDP/Annex B negotiation, RTP encode/decode, G.711 transcoding, and Asterisk/FreeSWITCH matrix coverage; excluded only from the general SIP full-media performance claim | [0.3.2 gate record](crates/sip/rvoip-sip/docs/BETA_GATE_EXCEPTION.md) |
+| AMR-NB and AMR-WB | **Available — developer preview** | Both variants behind `amr-nb`/`amr-wb`: encoders and decoders bit-exact against the 3GPP reference implementations over the committed fixtures and the normative sequences, RFC 4867 octet-aligned and bandwidth-efficient framing checked against Wireshark's dissector, DTX, CMR and mode negotiation, every mode exercised in a live call, SDES-SRTP, and live calls through Asterisk, FreeSWITCH, Kamailio and OpenSIPS; outside the SIP beta attestation | [AMR status](crates/media/codec-core/docs/AMR_IMPLEMENTATION_STATUS.md) |
 | Opus and G.722 paths | **Available — developer preview** | Feature-gated codec/media support; not part of the bounded SIP beta media claim | [`rvoip-media-core`](crates/media/media-core) |
 | OS audio devices | **Available — developer preview** | Microphone/speaker bridge, drift-free pacing, resampling, jitter buffering, mute-as-silence, and VU metering | [`02-softphone-audio`](examples/02-softphone-audio) |
 | Conference mixing | **Available — developer preview** | Lower-level N-way/N-1 mixing and conference monitoring primitives; not an integrated SIP beta conference product | [Media README](crates/media/media-core/README.md) |

ROADMAP.md

@@ -0,0 +1,124 @@
+# rvoip Roadmap
+
+**Updated:** 2026-08-11  
+**Purpose:** portfolio-level rollup of active and future work across the rvoip
+workspace. Detailed component plans remain authoritative for acceptance criteria
+and implementation history.
+
+## Status model
+
+- **Active** — accepted work with an existing detailed tracker.
+- **Future** — desired direction; not scheduled and not a support claim.
+- **Research** — requires standards, interoperability, dependency, or product
+  validation before implementation is committed.
+
+## Active engineering tracks
+
+| Track | Status | Detailed tracker |
+|---|---|---|
+| Open-internet media hardening | Active | [`docs/PRODUCTION_HARDENING_ROADMAP.md`](docs/PRODUCTION_HARDENING_ROADMAP.md) — DTLS fragmentation, crypto review, CI/hygiene follow-through |
+| Cross-product architecture gaps | Active | [`docs/GAP_PLAN.md`](docs/GAP_PLAN.md) — deferred v1.x/v2 work and protocol adapters |
+| UCTP completion | Active | [`crates/uctp/rvoip-uctp/UCTP_GAP_PLAN.md`](crates/uctp/rvoip-uctp/UCTP_GAP_PLAN.md) — browser bidi-stream interoperability and per-session SIP codec override |
+| SIP standards promotion | Active | [`docs/sip/SIP_RFC_COMPLIANCE.md`](docs/sip/SIP_RFC_COMPLIANCE.md#roadmap-rollup) — partial/type-only behaviors to promote with executable evidence |
+| SIP transport reliability | Active | [`crates/sip/sip-transport/TODO.md`](crates/sip/sip-transport/TODO.md) — failover, recovery, backpressure, load/stress, and interoperability |
+
+## Future protocols and products
+
+| Initiative | Status | Intended integration |
+|---|---|---|
+| SIP-over-QUIC | Future | Add a QUIC transport to `rvoip-sip-transport`; keep the SIP transaction/dialog layers transport-neutral. |
+| RTP-over-QUIC (RoQ) | Future | Add a codec-agnostic `rvoip-roq` adapter for RTP/RTCP over QUIC DATAGRAMs and, where useful, QUIC streams. Preserve UCTP's distinct datagram framing and bridge at the media-adapter boundary. |
+| **Lyra V2 over UCTP, RTP, SIP, and RoQ** | Research | Add an optional Lyra V2 codec backend, an experimental RTP payload mapping, UCTP capability negotiation, SIP SDP integration, and a Lyra-over-RoQ end-to-end proof. See the workstream below. |
+| Media over QUIC (MoQ) | Future | Extend the existing MoQ crates toward broadcast-scale fan-out and UCTP/WebRTC bridging. |
+| Multi-party SFU/MCU products | Future | Build integrated products on the shipped media and subscription-routing primitives. |
+| AAuth production graduation | Future | Graduate the experimental standards work after security and deployment evidence mature. |
+| Deeper AI participants | Future | Add multi-agent orchestration beyond the current pluggable provider harness. |
+| QUIC multipath/NAT traversal | Research | Re-evaluate `noq` or equivalent when direct peer-to-peer and mobile multipath requirements justify a `quinn`-compatible change. |
+
+## Lyra V2 + RTP-over-QUIC workstream
+
+### Goal
+
+Demonstrate a bidirectional voice session that encodes 20 ms PCM frames with
+Lyra V2, packetizes them as RTP, and carries the same RTP stream over either
+ordinary UDP or RoQ. The proof must work through both a UCTP Session and a SIP
+call controlled by `rvoip-sip`.
+
+This is initially an **experimental, controlled-endpoint profile**. Lyra does
+not currently have an IETF-standard RTP payload format or a broadly deployed
+IANA/SDP registration, and RoQ is not yet a broadly deployed production
+transport. The roadmap must not imply third-party interoperability until a
+stable specification and independent test evidence exist.
+
+### Component ownership
+
+1. **`rvoip-codec-core` — Lyra V2 codec backend**
+   - Add an opt-in feature and isolate the Google Lyra/TFLite native dependency
+     from default builds.
+   - Support mono 20 ms frames, 3.2/6/9.2 kbps, and the Lyra V2-supported
+     external sample rates.
+   - Expose encode/decode, bitrate selection, packet-loss concealment behavior,
+     and capability metadata through the existing codec abstractions.
+
+2. **`rvoip-rtp-core` — experimental Lyra RTP profile**
+   - Add packetizer/depacketizer support using a dynamic payload type.
+   - Define the controlled-profile SDP shape, initially following the proven
+     experimental convention `lyra/<clock-rate>/1` with a `bitrate` `fmtp`
+     parameter.
+   - Specify timestamp increments, frame aggregation rules, marker behavior,
+     loss handling, and maximum packet size. Keep the profile explicitly
+     namespaced/experimental until standardized.
+
+3. **`rvoip-uctp` — Lyra capability and bridge support**
+   - Advertise Lyra V2 clock rates, bitrates, frame duration, and experimental
+     RTP profile in `CapabilityDescriptor` negotiation.
+   - Carry Lyra RTP packets through the existing UCTP media datagram framing;
+     do not create a second codec-specific UCTP wire format.
+   - Add codec selection, mismatch refusal, and optional transcoding fallback
+     for UCTP-to-SIP bridges.
+
+4. **`rvoip-roq` — RTP/RTCP over QUIC**
+   - Implement RoQ flow-ID mapping over QUIC DATAGRAMs first; evaluate stream
+     modes separately so reliable delivery cannot accidentally add
+     head-of-line latency to conversational audio.
+   - Remain codec-agnostic, with Lyra V2 as the first low-bitrate audio proof
+     and Opus/G.711 as interoperability controls.
+   - Define RTCP/congestion-control ownership and whether QUIC transport
+     feedback can safely replace any RTCP feedback in each deployment mode.
+
+5. **`rvoip-sip` — negotiation and end-to-end product integration**
+   - Offer/answer the experimental Lyra RTP profile in SDP only when enabled.
+   - Complete the existing per-session codec-override gap so re-INVITEs and
+     UCTP/SIP bridges can select Lyra without changing global codec policy.
+   - Support SIP signaling with a media leg using Lyra RTP over UDP and a
+     bridged media leg using the same RTP packets over RoQ.
+   - Treat RoQ as a media transport selected by the media adapter, not as a new
+     SIP message encoding. SIP-over-QUIC remains a separate roadmap item.
+
+### Proof and qualification gates
+
+- Codec golden vectors and encode/decode round trips for every supported
+  bitrate and enabled clock rate.
+- RTP sequence/timestamp, loss, reordering, aggregation, and SDP negotiation
+  tests.
+- UCTP Lyra-to-Lyra loopback and UCTP-to-SIP bridge tests.
+- `rvoip-sip` calls using Lyra/RTP over UDP, then the same RTP flow tunneled over
+  QUIC DATAGRAMs through `rvoip-roq`.
+- Comparison runs against Opus and G.711 under clean, lossy, reordered, and
+  mobile-path-migration conditions.
+- Measure mouth-to-ear latency, CPU, memory, packet-loss behavior, and actual
+  wire bitrate at 20, 40, and 100 ms packetization intervals. Report codec,
+  RTP/RTCP, QUIC, and IP/UDP overhead separately.
+- Security review of QUIC-only transport encryption versus retaining SRTP for
+  end-to-end protection across a terminating RoQ gateway.
+- Independent endpoint interoperability before removing the experimental
+  label or making a compatibility claim.
+
+## Maintenance
+
+- Keep this file as the root portfolio rollup; do not copy detailed phase
+  histories into it.
+- Add new work here when it crosses crate/product boundaries. Keep crate-local
+  TODOs and acceptance details in the linked component tracker.
+- A published crate, feature flag, or experimental demo is not by itself a
+  production-readiness or interoperability claim.

crates/extensions/rvoip-vapi/src/types.rs

@@ -46,17 +46,22 @@ impl VapiAudioFormat {
 
     pub fn codec(self) -> CodecInfo {
         match self {
+            // Both advertise what this transport can carry rather than
+            // reporting a negotiation, so neither names a payload type.
+            // Both are static names that `codec_to_pt` already resolves.
             Self::MuLaw8Khz => CodecInfo {
                 name: "PCMU".into(),
                 clock_rate_hz: 8_000,
                 channels: 1,
                 fmtp: None,
+                payload_type: None,
             },
             Self::PcmS16Le16Khz => CodecInfo {
                 name: "pcm_s16le".into(),
                 clock_rate_hz: 16_000,
                 channels: 1,
                 fmtp: None,
+                payload_type: None,
             },
         }
     }