remoteRF-server 1.0.3__tar.gz → 1.0.5__tar.gz

{remoterf_server-1.0.3 → remoterf_server-1.0.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: remoteRF-server
-Version: 1.0.3
+Version: 1.0.5
 Summary: RemoteRF server-side control package
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
@@ -329,36 +329,10 @@ devices:
       serial: 31A2B3C
 ```
 
-Transmit is denied if `~/.config/remoterf/usrp_policy.yml` is missing,
-unreadable, invalid, or does not explicitly enable and bound the requested
-operation. Low-level writes are also denied unless both globally enabled and
-method/path/address allowlisted. A starting policy looks like:
-
-```yaml
-defaults:
-  tx_enabled: false
-  low_level_write_enabled: false
-
-devices:
-  "31A2B3C":
-    tx_enabled: true
-    tx_frequency_ranges_hz:
-      - [902000000, 928000000]
-    max_tx_gain_db: 20
-    max_tx_normalized_gain: 0.5
-    max_tx_power_dbm: -10
-    max_tx_bandwidth_hz: 2000000
-    max_tx_sample_rate_sps: 2000000
-    allowed_tx_antennas: [TX/RX]
-    max_burst_seconds: 1.0
-    max_duty_cycle: 0.1
-    duty_cycle_window_seconds: 60
-    low_level_write_enabled: false
-    low_level_write_methods: []
-    gpio_write_masks: {}
-    property_write_paths: []
-    register_write_addresses: []
-```
+All USRP operations exposed by the Dynamic v2 schema are available without a
+separate policy file. This includes transmit controls, transmit streaming,
+GPIO/register methods, and property-tree writes. `usrp_policy.yml` is not read
+or required by the current server.
 
 On every qualified target, generate the introspection record and enforce the
 pinned API gate:

{remoterf_server-1.0.3 → remoterf_server-1.0.5}/README.md

@@ -314,36 +314,10 @@ devices:
       serial: 31A2B3C
 ```
 
-Transmit is denied if `~/.config/remoterf/usrp_policy.yml` is missing,
-unreadable, invalid, or does not explicitly enable and bound the requested
-operation. Low-level writes are also denied unless both globally enabled and
-method/path/address allowlisted. A starting policy looks like:
-
-```yaml
-defaults:
-  tx_enabled: false
-  low_level_write_enabled: false
-
-devices:
-  "31A2B3C":
-    tx_enabled: true
-    tx_frequency_ranges_hz:
-      - [902000000, 928000000]
-    max_tx_gain_db: 20
-    max_tx_normalized_gain: 0.5
-    max_tx_power_dbm: -10
-    max_tx_bandwidth_hz: 2000000
-    max_tx_sample_rate_sps: 2000000
-    allowed_tx_antennas: [TX/RX]
-    max_burst_seconds: 1.0
-    max_duty_cycle: 0.1
-    duty_cycle_window_seconds: 60
-    low_level_write_enabled: false
-    low_level_write_methods: []
-    gpio_write_masks: {}
-    property_write_paths: []
-    register_write_addresses: []
-```
+All USRP operations exposed by the Dynamic v2 schema are available without a
+separate policy file. This includes transmit controls, transmit streaming,
+GPIO/register methods, and property-tree writes. `usrp_policy.yml` is not read
+or required by the current server.
 
 On every qualified target, generate the introspection record and enforce the
 pinned API gate:

{remoterf_server-1.0.3 → remoterf_server-1.0.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "remoteRF-server"
-version = "1.0.3"
+version = "1.0.5"
 description = "RemoteRF server-side control package"
 requires-python = ">=3.10"
 dependencies = [

{remoterf_server-1.0.3 → remoterf_server-1.0.5}/src/remoteRF_server/common/idl/schema.py

@@ -6,7 +6,7 @@ Admin writes one .py per device TYPE, drops it in ~/.config/remoterf/drivers/,
 and the server auto-discovers it on startup via load_drivers().
 
     ~/.config/remoterf/
-        devices.env                 ← "I have 3 plutos at these serials"
+        devices.yml                 ← "I have 3 devices at these serials"
         drivers/
             pluto_schema.py         ← "here's what a pluto IS"
             hackrf_schema.py
@@ -531,7 +531,7 @@ class DeviceSchema:
     Base for all device schemas.  Admin subclasses this once per device type.
 
     Class attributes (admin sets these):
-        device_type      str   — must match the TYPE in devices.env
+        device_type      str   — must match device_type in devices.yml
         driver_version   str   — semver
 
     Admin implements:

remoterf_server-1.0.5/src/remoteRF_server/drivers/usrp/policy.py

@@ -0,0 +1,41 @@
+"""Compatibility shim for unrestricted USRP access.
+
+USRP policy enforcement is currently disabled. ``USRPPolicy`` remains importable
+so older integrations do not fail at import time, but every supported control,
+streaming, property-tree, GPIO, and register operation passes through without
+policy checks.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any, Mapping
+
+
+class USRPPolicy:
+    """No-op policy retained for protocol and integration compatibility."""
+
+    def __init__(self, config: Mapping[str, Any] | None = None, *, source: str = ""):
+        self.config = dict(config or {})
+        self.source = source
+
+    @classmethod
+    def load(cls, *, gid: int, serial: str = "", path: Path | None = None) -> "USRPPolicy":
+        del gid, serial, path
+        return cls()
+
+    @property
+    def tx_enabled(self) -> bool:
+        return True
+
+    @property
+    def restrictions(self) -> dict[str, Any]:
+        return {}
+
+    def check_control(self, method: str, args: Mapping[str, Any]) -> None:
+        del method, args
+
+    def check_tx_duration(self, duration: float) -> None:
+        del duration
+
+    def check_handle_call(self, type_id: str, method: str, args: Mapping[str, Any]) -> None:
+        del type_id, method, args

{remoterf_server-1.0.3 → remoterf_server-1.0.5}/src/remoteRF_server/drivers/usrp/uhd_manifest.py

@@ -135,11 +135,6 @@ HANDLE_METHOD_RETURN_TYPES = {
     ("uhd.property.dboard_iface", "get_desired"): "uhd.usrp.dboard_iface",
 }
 
-LOW_LEVEL_WRITES = {
-    "set_gpio_attr", "set_gpio_src", "set_user_register",
-    "set_rx_filter", "set_tx_filter",
-}
-
 USRP2901_UNSUPPORTED_HANDLE_TYPES = {
     "uhd.usrp.radio_control",
     "uhd.usrp.mboard_controller",
@@ -1305,7 +1300,7 @@ def _objects() -> list[dict]:
             "uhd.property_tree",
             kind="remote_handle",
             mutability="remote_handle",
-            ownership={"scope": "session", "default_access": "read_only"},
+            ownership={"scope": "session", "default_access": "read_write"},
         ),
         *[
             object_type(
@@ -1315,7 +1310,7 @@ def _objects() -> list[dict]:
                 ownership={
                     "scope": "session",
                     "parent": "uhd.property_tree",
-                    "default_access": "read_only",
+                    "default_access": "read_write",
                 },
             )
             for suffix in (
@@ -1331,25 +1326,25 @@ def _objects() -> list[dict]:
             "uhd.usrp.radio_control",
             kind="remote_handle",
             mutability="remote_handle",
-            ownership={"scope": "session", "default_access": "read_only"},
+            ownership={"scope": "session", "default_access": "read_write"},
         ),
         object_type(
             "uhd.usrp.mboard_controller",
             kind="remote_handle",
             mutability="remote_handle",
-            ownership={"scope": "session", "default_access": "read_only"},
+            ownership={"scope": "session", "default_access": "read_write"},
         ),
         object_type(
             "uhd.usrp.dboard_iface",
             kind="remote_handle",
             mutability="remote_handle",
-            ownership={"scope": "session", "default_access": "read_only"},
+            ownership={"scope": "session", "default_access": "read_write"},
         ),
         object_type(
             "uhd.usrp.user_settings_iface",
             kind="remote_handle",
             mutability="remote_handle",
-            ownership={"scope": "session", "default_access": "read_only"},
+            ownership={"scope": "session", "default_access": "read_write"},
         ),
     ]
 
@@ -1415,7 +1410,6 @@ def _streamer_methods() -> list[dict]:
                 )
             ],
             execution="sample_stream",
-            policy="tx_samples",
         ),
         method(
             "recv_async_msg", "uhd.usrp.TXStreamer",
@@ -1514,7 +1508,6 @@ def _property_tree_methods() -> list[dict]:
                         )
                     ],
                     execution="server_handle",
-                    policy="low_level_write",
                 )
             )
     return methods
@@ -1531,13 +1524,13 @@ CAPABILITY_FIELDS = (
     "tx_bandwidth_ranges_per_channel", "master_clock_rate_range", "time_sources",
     "clock_sources", "gpio_banks", "sensors", "supported_cpu_formats",
     "supported_otw_formats", "maximum_remote_payload_bytes",
-    "supported_streaming_protocol_versions", "policy_restrictions",
+    "supported_streaming_protocol_versions",
     "remote_resource_limits", "advanced_interfaces",
 )
 
 ERRORS = (
     "RemoteRFTransportError", "RemoteRFSessionExpiredError",
-    "RemoteRFReservationError", "RemoteRFPolicyError",
+    "RemoteRFReservationError",
     "RemoteRFStaleHandleError", "RemoteRFProtocolError",
     "RemoteRFOverloadError",
     "RemoteRFServerOverloadedError", "RemoteRFNativeUHDError",
@@ -1558,15 +1551,6 @@ def build_usrp_schema_v2(driver_version: str = "0.0.1") -> dict:
     coverage: dict[str, str] = {}
     for name in MULTIUSRP_METHODS:
         execution = "server_optimized" if name in {"recv_num_samps", "send_waveform"} else "server_control"
-        policy = None
-        if (
-            name.startswith("set_tx_")
-            or name == "set_normalized_tx_gain"
-            or name == "send_waveform"
-        ):
-            policy = "tx_control"
-        elif name in LOW_LEVEL_WRITES:
-            policy = "low_level_write"
         availability = {"runtime_member": name}
         if name in OPTIONAL_METHODS:
             availability["optional"] = True
@@ -1577,7 +1561,6 @@ def build_usrp_schema_v2(driver_version: str = "0.0.1") -> dict:
                 signatures.get(name, _fallback_overload()),
                 execution=execution,
                 availability=availability,
-                policy=policy,
             )
         )
         coverage[f"uhd.usrp.MultiUSRP.{name}"] = (

{remoterf_server-1.0.3 → remoterf_server-1.0.5}/src/remoteRF_server/drivers/usrp/usrp_schema.py

@@ -518,7 +518,7 @@ class UsrpSchema(DeviceSchema):
                 return str(value)
         return ""
 
-    def get_capabilities_v2(self, *, policy_restrictions=None):
+    def get_capabilities_v2(self):
         device = self.device
         if device is None:
             raise RuntimeError("USRP session is not open")
@@ -615,7 +615,6 @@ class UsrpSchema(DeviceSchema):
             },
             "maximum_remote_payload_bytes": 4 * 1024 * 1024,
             "supported_streaming_protocol_versions": ["1.0"],
-            "policy_restrictions": dict(policy_restrictions or {}),
         }
 
     def _streamers(self):

{remoterf_server-1.0.3 → remoterf_server-1.0.5}/src/remoteRF_server/server/device_manager.py

@@ -314,6 +314,11 @@ def _load_device_records() -> Dict[int, Dict[str, str]]:
 def _connect_from_record(rec: Dict[str, Any]):
     """Returns (schema_instance_or_None, ident, dtype)."""
     dtype = (rec.get("TYPE") or "").strip().lower()
+    # Older serverrf builds serialized the --pluto shorthand as "pluto",
+    # while the packaged schema has always registered as "adalm_pluto".
+    # Keep those inventories usable while all new writes use the canonical type.
+    if dtype == "pluto":
+        dtype = "adalm_pluto"
     ident = (rec.get("IDENT") or "").strip()
     init_kwargs = rec.get("INIT") or {}
 
@@ -873,7 +878,7 @@ def acquire_device(api_token: str) -> Iterator[Tuple[int, object]]:
 
 def reload_devices() -> None:
     """
-    Reload devices.env and reconnect local devices.
+    Reload devices.yml and reconnect local devices.
     Preserves existing salt/hash for devices that remain (same gid),
     and preserves host virtual devices + their auth state.
     """

{remoterf_server-1.0.3 → remoterf_server-1.0.5}/src/remoteRF_server/server/dynamic_v2.py

@@ -23,6 +23,8 @@ from ..common.idl.v2 import (
     SCHEMA_VERSION,
     STREAMING_PROTOCOL_VERSION,
 )
+# Retained as a module attribute for integrations that patched the former
+# policy loader. Runtime access is no longer gated by it.
 from ..drivers.usrp.policy import USRPPolicy
 from ..drivers.usrp.uhd_manifest import (
     HANDLE_METHOD_RETURN_TYPES,
@@ -39,7 +41,6 @@ from .device_manager import (
 from .v2_errors import (
     RemoteRFNativeUHDError,
     RemoteRFOverloadError,
-    RemoteRFPolicyError,
     RemoteRFProtocolError,
     RemoteRFReservationError,
     RemoteRFServerOverloadedError,
@@ -466,7 +467,6 @@ class DeviceSession:
     gid: int
     schema: Any
     schema_v2: dict
-    policy: USRPPolicy
     root_handle: str
     capabilities: dict
     handles: dict[str, HandleEntry] = field(default_factory=dict)
@@ -569,10 +569,7 @@ class SessionManager:
                     "the USRP is already open through a legacy v1 session"
                 )
             live_schema = create()
-            policy = USRPPolicy.load(gid=gid, serial=context.get("ident", ""))
-            capabilities = live_schema.get_capabilities_v2(
-                policy_restrictions=policy.restrictions
-            )
+            capabilities = live_schema.get_capabilities_v2()
             capabilities["remote_resource_limits"] = {
                 "maximum_sessions": _MAX_SESSIONS,
                 "maximum_handles_per_session": _MAX_HANDLES_PER_SESSION,
@@ -601,7 +598,6 @@ class SessionManager:
             gid=gid,
             schema=live_schema,
             schema_v2=schema_v2,
-            policy=policy,
             root_handle=root_handle,
             capabilities=capabilities,
         )
@@ -865,10 +861,6 @@ class SessionManager:
                 args,
                 positional_args,
             )
-            policy_args = dict(args)
-            if positional_args:
-                policy_args["__args__"] = positional_args
-            session.policy.check_control(method_name, policy_args)
             native_args = {
                 key: self._resolve_handle_argument(session, value)
                 for key, value in args.items()
@@ -884,7 +876,7 @@ class SessionManager:
                         native_args,
                         positional_args=native_positional,
                     )
-                except (RemoteRFPolicyError, RemoteRFProtocolError):
+                except RemoteRFProtocolError:
                     raise
                 except Exception as exc:
                     raise RemoteRFNativeUHDError(
@@ -953,15 +945,6 @@ class SessionManager:
             except queue.Empty:
                 return (False if mutate_metadata else None), mutations
 
-        if not entry.type_id.endswith(("RXStreamer", "TXStreamer")):
-            policy_args = dict(args)
-            if positional_args:
-                policy_args["__args__"] = positional_args
-            session.policy.check_handle_call(
-                entry.type_id,
-                method_name,
-                policy_args,
-            )
         target = getattr(entry.value, method_name, None)
         if not callable(target):
             raise RemoteRFProtocolError(
@@ -1413,19 +1396,6 @@ class SampleDataV1Servicer(grpc_pb2_grpc.SampleDataV1Servicer):
                     ):
                         if not entry.type_id.endswith("TXStreamer"):
                             raise RemoteRFStaleHandleError("TX data used a non-TX handle")
-                        channels = entry.stream_channels or [0]
-                        rates = []
-                        get_rate = getattr(session.schema.device, "get_tx_rate", None)
-                        if callable(get_rate):
-                            for channel in channels:
-                                rates.append(float(get_rate(channel)))
-                        if not rates or min(rates) <= 0:
-                            raise RemoteRFPolicyError(
-                                "TX sample rate is unavailable for duty-cycle enforcement"
-                            )
-                        session.policy.check_tx_duration(
-                            float(request.sample_count) / min(rates)
-                        )
                         if len(request.payload) != byte_count:
                             raise RemoteRFProtocolError(
                                 "TX payload byte length does not match dtype/shape"

{remoterf_server-1.0.3 → remoterf_server-1.0.5}/src/remoteRF_server/server/grpc_server.py

@@ -214,6 +214,18 @@ def _load_server_credentials(cert_dir: Path):
     )
 
 
+def _print_tls_credentials_error(cert_dir: Path, error: Exception) -> None:
+    messages = (
+        "TLS certs/keys not found or unreadable.",
+        f"Expected in: {cert_dir}",
+        f"Fix: run serverrf --gen-certs {local_ip} --force",
+        "Or set REMOTERF_CERT_DIR to your cert folder.",
+        f"Details: {error}",
+    )
+    for message in messages:
+        printf(message, Sty.MAGENTA)
+
+
 def start_server_runtime(
     *,
     bind_host: str | None = None,
@@ -258,11 +270,7 @@ def start_server_runtime(
     try:
         server_credentials = _load_server_credentials(cert_dir)
     except Exception as e:
-        printf("TLS certs/keys not found or unreadable.", Sty.RED)
-        printf("Expected in: ", Sty.DEFAULT, f"{cert_dir}", Sty.MAGENTA)
-        printf("Fix: run ", Sty.DEFAULT, "RRRFcerts --ip ", Sty.GREEN, f"{local_ip}", Sty.MAGENTA, " --force", Sty.DEFAULT)
-        printf("Or set REMOTERF_CERT_DIR to your cert folder.", Sty.GRAY)
-        print(f"\nDetails: {e}\n", file=sys.stderr)
+        _print_tls_credentials_error(cert_dir, e)
         raise SystemExit(2)
 
     if include_host_tunnel:

{remoterf_server-1.0.3 → remoterf_server-1.0.5}/src/remoteRF_server/serverrf_cli.py

@@ -135,7 +135,7 @@ def _server_env_path() -> Path:
 
 
 def _devices_env_path() -> Path:
-    # Legacy mirror retained for older tooling.
+    # Read-only migration source for pre-YAML installations.
     return _cfg_dir() / "devices.env"
 
 
@@ -156,11 +156,11 @@ def _gen_certs_path() -> Path:
     return (_repo_root() / "tools" / "gen_certs.py").resolve()
 
 def _gist_env_path() -> Path:
-    # Stored alongside server.env/devices.env under ~/.config/remoterf by default
+    # Stored alongside server.env/devices.yml under ~/.config/remoterf by default
     return _cfg_dir() / "gist.env"
 
 def _tos_ack_path() -> Path:
-    # Stored alongside server.env/devices.env under ~/.config/remoterf by default
+    # Stored alongside server.env/devices.yml under ~/.config/remoterf by default
     return _cfg_dir() / "tos.env"
 
 
@@ -262,6 +262,7 @@ def print_help() -> None:
         "\n"
         "Devices:\n"
         "  serverrf -d | --device [options]\n"
+        "  Inventory: ~/.config/remoterf/devices.yml (canonical YAML)\n"
         "\n"
         "Device options:\n"
         "  --add --pluto <id:name:iio_serial>  Add an ADALM-Pluto\n"
@@ -811,7 +812,11 @@ def _read_device_records() -> Dict[int, Dict[str, Any]]:
                 recs[gid] = {
                     "TYPE": dtype,
                     "NAME": str(item.get("name") or f"device-{gid}").strip(),
-                    "IDENT_KIND": "iio_serial" if dtype == "pluto" else "serial",
+                    "IDENT_KIND": (
+                        "iio_serial"
+                        if dtype in {"pluto", "adalm_pluto"}
+                        else "serial"
+                    ),
                     "IDENT": ident,
                     "INIT": dict(init),
                 }
@@ -833,7 +838,6 @@ def _read_device_records() -> Dict[int, Dict[str, Any]]:
 
 def _write_device_records(recs: Dict[int, Dict[str, Any]]) -> None:
     devices: List[Dict[str, Any]] = []
-    out: Dict[str, str] = {}
     for gid in sorted(recs.keys()):
         fields = recs[gid]
         dtype = str(fields.get("TYPE") or "").strip().lower()
@@ -852,22 +856,14 @@ def _write_device_records(recs: Dict[int, Dict[str, Any]]) -> None:
                 "init": init,
             }
         )
-        order = ["TYPE", "NAME", "IDENT_KIND", "IDENT"]
-        for f in order:
-            if f in fields and fields[f] != "":
-                out[f"DEVICE_{gid}_{f}"] = str(fields[f])
-        for f in sorted(fields.keys()):
-            if f in order or f == "INIT":
-                continue
-            if fields[f] != "":
-                out[f"DEVICE_{gid}_{f}"] = str(fields[f])
     _cfg_dir().mkdir(parents=True, exist_ok=True)
     _devices_yaml_path().write_text(
         yaml.safe_dump({"devices": devices}, sort_keys=False),
         encoding="utf-8",
     )
-    # Maintain the original env representation for older CLI consumers.
-    _write_env_kv(_devices_env_path(), out)
+    # Once a legacy inventory has been migrated successfully, remove it so
+    # there is exactly one authoritative device manifest.
+    _devices_env_path().unlink(missing_ok=True)
 
 
 def _device_add_pluto(spec: str) -> int:
@@ -894,14 +890,14 @@ def _device_add_pluto(spec: str) -> int:
             return 2
 
     recs[gid] = {
-        "TYPE": "pluto",
+        "TYPE": "adalm_pluto",
         "NAME": name,
         "IDENT_KIND": "iio_serial",
         "IDENT": iio_serial,
     }
     _write_device_records(recs)
 
-    print(f"Added device: {gid} type=pluto name={name} iio_serial={iio_serial}")
+    print(f"Added device: {gid} type=adalm_pluto name={name} iio_serial={iio_serial}")
     return 0
 
 

{remoterf_server-1.0.3 → remoterf_server-1.0.5}/src/remoteRF_server.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: remoteRF-server
-Version: 1.0.3
+Version: 1.0.5
 Summary: RemoteRF server-side control package
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
@@ -329,36 +329,10 @@ devices:
       serial: 31A2B3C
 ```
 
-Transmit is denied if `~/.config/remoterf/usrp_policy.yml` is missing,
-unreadable, invalid, or does not explicitly enable and bound the requested
-operation. Low-level writes are also denied unless both globally enabled and
-method/path/address allowlisted. A starting policy looks like:
-
-```yaml
-defaults:
-  tx_enabled: false
-  low_level_write_enabled: false
-
-devices:
-  "31A2B3C":
-    tx_enabled: true
-    tx_frequency_ranges_hz:
-      - [902000000, 928000000]
-    max_tx_gain_db: 20
-    max_tx_normalized_gain: 0.5
-    max_tx_power_dbm: -10
-    max_tx_bandwidth_hz: 2000000
-    max_tx_sample_rate_sps: 2000000
-    allowed_tx_antennas: [TX/RX]
-    max_burst_seconds: 1.0
-    max_duty_cycle: 0.1
-    duty_cycle_window_seconds: 60
-    low_level_write_enabled: false
-    low_level_write_methods: []
-    gpio_write_masks: {}
-    property_write_paths: []
-    register_write_addresses: []
-```
+All USRP operations exposed by the Dynamic v2 schema are available without a
+separate policy file. This includes transmit controls, transmit streaming,
+GPIO/register methods, and property-tree writes. `usrp_policy.yml` is not read
+or required by the current server.
 
 On every qualified target, generate the introspection record and enforce the
 pinned API gate:

{remoterf_server-1.0.3 → remoterf_server-1.0.5}/tests/test_cert_provider.py

@@ -59,6 +59,30 @@ class CertificateProviderTests(unittest.TestCase):
         self.assertEqual(served, ca_pem)
         self.assertNotEqual(served, leaf_pem)
 
+    def test_missing_tls_guidance_is_visible_and_uses_serverrf(self):
+        from remoteRF_server.server import grpc_server
+
+        cert_dir = Path("/tmp/remoterf-test-certs")
+        error = FileNotFoundError("missing server.key")
+        with patch.object(grpc_server, "printf") as mock_printf:
+            grpc_server._print_tls_credentials_error(cert_dir, error)
+
+        rendered = [call.args for call in mock_printf.call_args_list]
+        self.assertEqual(
+            [message for message, _style in rendered],
+            [
+                "TLS certs/keys not found or unreadable.",
+                f"Expected in: {cert_dir}",
+                f"Fix: run serverrf --gen-certs {grpc_server.local_ip} --force",
+                "Or set REMOTERF_CERT_DIR to your cert folder.",
+                "Details: missing server.key",
+            ],
+        )
+        self.assertTrue(
+            all(style is grpc_server.Sty.MAGENTA for _message, style in rendered)
+        )
+        self.assertNotIn("RRRFcerts", "\n".join(message for message, _style in rendered))
+
 
 if __name__ == "__main__":
     unittest.main()