Module rtp 

RTP server (RFC 3550).

Binds a UDP socket and speaks Real-time Transport Protocol. When a datagram arrives it is parsed as RTP (or RTCP) and turned into an event; the model answers by describing what the stream should carry (a tone, DTMF, silence) and this server synthesizes G.711 and frames it into correct RTP packets sent back to the peer. See media.rs for the VNC-style text-to-media engine, shared with the rtsp control server.

RTP is high-rate, so the model is behind a budget

A single G.711 stream is 50 packets per second, and the model does not belong on that path: one LLM call per inbound datagram would exhaust the budget in seconds, and every consultation that does happen can authorize up to 30 seconds of outbound media — so an attacker spoofing a source address gets an amplifier as well. Two gates stand in front of call_llm, in the shape src/server/tuntap/ established:

  datagram ─▶ GATE 1  run the handler; did it ANSWER?  ── yes ──▶ no model call, always runs
             │        (script / static / manual rule)
             └─▶ GATE 2  a rolling per-minute budget   ── over ──▶ dropped,
                         (`llm_max_per_minute`, 30)                decision=fail_closed_rate_limited

Gate 1 is why the budget is safe to set low: script and static handlers are the intended way to run RTP at rate and are never charged. The exemption is decided by the handler’s answer, not by its presence in the routing table — a Script rule whose language is unknown, whose interpreter is missing, or whose code throws answers FallbackToLlm, and such a datagram is charged like any unclaimed one. Deciding this from configuration was a live defect in this file: call_llm dispatches the handler itself, so a declining script reached the model with the budget already skipped, at wire rate, with llm_max_per_minute inert. See tests/handler_result_decides_the_bound_test.rs and tests/server/rtp/script_fallback_budget_test.rs.

Gate 2 is a ceiling, not a smoothing filter — a sliding window rather than a leaky bucket, so “never more than N in any minute” is literally true. Setting llm_max_per_minute to 0 forbids model consultation outright, which is the right configuration for a server driven entirely by handlers.

Modules

actions

RTP protocol actions.

media

RTP media synthesis and packetization (RFC 3550).

Structs

RtpConfig

Startup configuration read from declared parameters.

RtpLlmBudget

A rolling one-minute ceiling on model consultations.

RtpServer

RTP server that generates/answers media streams under LLM control.

Constants

DEFAULT_LLM_MAX_PER_MINUTE

Default ceiling on model consultations per rolling minute.