remoteRF-server 1.0.4__tar.gz → 1.0.5__tar.gz

{remoterf_server-1.0.4 → remoterf_server-1.0.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: remoteRF-server
-Version: 1.0.4
+Version: 1.0.5
 Summary: RemoteRF server-side control package
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
@@ -329,36 +329,10 @@ devices:
       serial: 31A2B3C
 ```
 
-Transmit is denied if `~/.config/remoterf/usrp_policy.yml` is missing,
-unreadable, invalid, or does not explicitly enable and bound the requested
-operation. Low-level writes are also denied unless both globally enabled and
-method/path/address allowlisted. A starting policy looks like:
-
-```yaml
-defaults:
-  tx_enabled: false
-  low_level_write_enabled: false
-
-devices:
-  "31A2B3C":
-    tx_enabled: true
-    tx_frequency_ranges_hz:
-      - [902000000, 928000000]
-    max_tx_gain_db: 20
-    max_tx_normalized_gain: 0.5
-    max_tx_power_dbm: -10
-    max_tx_bandwidth_hz: 2000000
-    max_tx_sample_rate_sps: 2000000
-    allowed_tx_antennas: [TX/RX]
-    max_burst_seconds: 1.0
-    max_duty_cycle: 0.1
-    duty_cycle_window_seconds: 60
-    low_level_write_enabled: false
-    low_level_write_methods: []
-    gpio_write_masks: {}
-    property_write_paths: []
-    register_write_addresses: []
-```
+All USRP operations exposed by the Dynamic v2 schema are available without a
+separate policy file. This includes transmit controls, transmit streaming,
+GPIO/register methods, and property-tree writes. `usrp_policy.yml` is not read
+or required by the current server.
 
 On every qualified target, generate the introspection record and enforce the
 pinned API gate:

{remoterf_server-1.0.4 → remoterf_server-1.0.5}/README.md

@@ -314,36 +314,10 @@ devices:
       serial: 31A2B3C
 ```
 
-Transmit is denied if `~/.config/remoterf/usrp_policy.yml` is missing,
-unreadable, invalid, or does not explicitly enable and bound the requested
-operation. Low-level writes are also denied unless both globally enabled and
-method/path/address allowlisted. A starting policy looks like:
-
-```yaml
-defaults:
-  tx_enabled: false
-  low_level_write_enabled: false
-
-devices:
-  "31A2B3C":
-    tx_enabled: true
-    tx_frequency_ranges_hz:
-      - [902000000, 928000000]
-    max_tx_gain_db: 20
-    max_tx_normalized_gain: 0.5
-    max_tx_power_dbm: -10
-    max_tx_bandwidth_hz: 2000000
-    max_tx_sample_rate_sps: 2000000
-    allowed_tx_antennas: [TX/RX]
-    max_burst_seconds: 1.0
-    max_duty_cycle: 0.1
-    duty_cycle_window_seconds: 60
-    low_level_write_enabled: false
-    low_level_write_methods: []
-    gpio_write_masks: {}
-    property_write_paths: []
-    register_write_addresses: []
-```
+All USRP operations exposed by the Dynamic v2 schema are available without a
+separate policy file. This includes transmit controls, transmit streaming,
+GPIO/register methods, and property-tree writes. `usrp_policy.yml` is not read
+or required by the current server.
 
 On every qualified target, generate the introspection record and enforce the
 pinned API gate:

{remoterf_server-1.0.4 → remoterf_server-1.0.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "remoteRF-server"
-version = "1.0.4"
+version = "1.0.5"
 description = "RemoteRF server-side control package"
 requires-python = ">=3.10"
 dependencies = [

remoterf_server-1.0.5/src/remoteRF_server/drivers/usrp/policy.py

@@ -0,0 +1,41 @@
+"""Compatibility shim for unrestricted USRP access.
+
+USRP policy enforcement is currently disabled. ``USRPPolicy`` remains importable
+so older integrations do not fail at import time, but every supported control,
+streaming, property-tree, GPIO, and register operation passes through without
+policy checks.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any, Mapping
+
+
+class USRPPolicy:
+    """No-op policy retained for protocol and integration compatibility."""
+
+    def __init__(self, config: Mapping[str, Any] | None = None, *, source: str = ""):
+        self.config = dict(config or {})
+        self.source = source
+
+    @classmethod
+    def load(cls, *, gid: int, serial: str = "", path: Path | None = None) -> "USRPPolicy":
+        del gid, serial, path
+        return cls()
+
+    @property
+    def tx_enabled(self) -> bool:
+        return True
+
+    @property
+    def restrictions(self) -> dict[str, Any]:
+        return {}
+
+    def check_control(self, method: str, args: Mapping[str, Any]) -> None:
+        del method, args
+
+    def check_tx_duration(self, duration: float) -> None:
+        del duration
+
+    def check_handle_call(self, type_id: str, method: str, args: Mapping[str, Any]) -> None:
+        del type_id, method, args

{remoterf_server-1.0.4 → remoterf_server-1.0.5}/src/remoteRF_server/drivers/usrp/uhd_manifest.py

@@ -135,11 +135,6 @@ HANDLE_METHOD_RETURN_TYPES = {
     ("uhd.property.dboard_iface", "get_desired"): "uhd.usrp.dboard_iface",
 }
 
-LOW_LEVEL_WRITES = {
-    "set_gpio_attr", "set_gpio_src", "set_user_register",
-    "set_rx_filter", "set_tx_filter",
-}
-
 USRP2901_UNSUPPORTED_HANDLE_TYPES = {
     "uhd.usrp.radio_control",
     "uhd.usrp.mboard_controller",
@@ -1305,7 +1300,7 @@ def _objects() -> list[dict]:
             "uhd.property_tree",
             kind="remote_handle",
             mutability="remote_handle",
-            ownership={"scope": "session", "default_access": "read_only"},
+            ownership={"scope": "session", "default_access": "read_write"},
         ),
         *[
             object_type(
@@ -1315,7 +1310,7 @@ def _objects() -> list[dict]:
                 ownership={
                     "scope": "session",
                     "parent": "uhd.property_tree",
-                    "default_access": "read_only",
+                    "default_access": "read_write",
                 },
             )
             for suffix in (
@@ -1331,25 +1326,25 @@ def _objects() -> list[dict]:
             "uhd.usrp.radio_control",
             kind="remote_handle",
             mutability="remote_handle",
-            ownership={"scope": "session", "default_access": "read_only"},
+            ownership={"scope": "session", "default_access": "read_write"},
         ),
         object_type(
             "uhd.usrp.mboard_controller",
             kind="remote_handle",
             mutability="remote_handle",
-            ownership={"scope": "session", "default_access": "read_only"},
+            ownership={"scope": "session", "default_access": "read_write"},
         ),
         object_type(
             "uhd.usrp.dboard_iface",
             kind="remote_handle",
             mutability="remote_handle",
-            ownership={"scope": "session", "default_access": "read_only"},
+            ownership={"scope": "session", "default_access": "read_write"},
         ),
         object_type(
             "uhd.usrp.user_settings_iface",
             kind="remote_handle",
             mutability="remote_handle",
-            ownership={"scope": "session", "default_access": "read_only"},
+            ownership={"scope": "session", "default_access": "read_write"},
         ),
     ]
 
@@ -1415,7 +1410,6 @@ def _streamer_methods() -> list[dict]:
                 )
             ],
             execution="sample_stream",
-            policy="tx_samples",
         ),
         method(
             "recv_async_msg", "uhd.usrp.TXStreamer",
@@ -1514,7 +1508,6 @@ def _property_tree_methods() -> list[dict]:
                         )
                     ],
                     execution="server_handle",
-                    policy="low_level_write",
                 )
             )
     return methods
@@ -1531,13 +1524,13 @@ CAPABILITY_FIELDS = (
     "tx_bandwidth_ranges_per_channel", "master_clock_rate_range", "time_sources",
     "clock_sources", "gpio_banks", "sensors", "supported_cpu_formats",
     "supported_otw_formats", "maximum_remote_payload_bytes",
-    "supported_streaming_protocol_versions", "policy_restrictions",
+    "supported_streaming_protocol_versions",
     "remote_resource_limits", "advanced_interfaces",
 )
 
 ERRORS = (
     "RemoteRFTransportError", "RemoteRFSessionExpiredError",
-    "RemoteRFReservationError", "RemoteRFPolicyError",
+    "RemoteRFReservationError",
     "RemoteRFStaleHandleError", "RemoteRFProtocolError",
     "RemoteRFOverloadError",
     "RemoteRFServerOverloadedError", "RemoteRFNativeUHDError",
@@ -1558,15 +1551,6 @@ def build_usrp_schema_v2(driver_version: str = "0.0.1") -> dict:
     coverage: dict[str, str] = {}
     for name in MULTIUSRP_METHODS:
         execution = "server_optimized" if name in {"recv_num_samps", "send_waveform"} else "server_control"
-        policy = None
-        if (
-            name.startswith("set_tx_")
-            or name == "set_normalized_tx_gain"
-            or name == "send_waveform"
-        ):
-            policy = "tx_control"
-        elif name in LOW_LEVEL_WRITES:
-            policy = "low_level_write"
         availability = {"runtime_member": name}
         if name in OPTIONAL_METHODS:
             availability["optional"] = True
@@ -1577,7 +1561,6 @@ def build_usrp_schema_v2(driver_version: str = "0.0.1") -> dict:
                 signatures.get(name, _fallback_overload()),
                 execution=execution,
                 availability=availability,
-                policy=policy,
             )
         )
         coverage[f"uhd.usrp.MultiUSRP.{name}"] = (

{remoterf_server-1.0.4 → remoterf_server-1.0.5}/src/remoteRF_server/drivers/usrp/usrp_schema.py

@@ -518,7 +518,7 @@ class UsrpSchema(DeviceSchema):
                 return str(value)
         return ""
 
-    def get_capabilities_v2(self, *, policy_restrictions=None):
+    def get_capabilities_v2(self):
         device = self.device
         if device is None:
             raise RuntimeError("USRP session is not open")
@@ -615,7 +615,6 @@ class UsrpSchema(DeviceSchema):
             },
             "maximum_remote_payload_bytes": 4 * 1024 * 1024,
             "supported_streaming_protocol_versions": ["1.0"],
-            "policy_restrictions": dict(policy_restrictions or {}),
         }
 
     def _streamers(self):

{remoterf_server-1.0.4 → remoterf_server-1.0.5}/src/remoteRF_server/server/dynamic_v2.py

@@ -23,6 +23,8 @@ from ..common.idl.v2 import (
     SCHEMA_VERSION,
     STREAMING_PROTOCOL_VERSION,
 )
+# Retained as a module attribute for integrations that patched the former
+# policy loader. Runtime access is no longer gated by it.
 from ..drivers.usrp.policy import USRPPolicy
 from ..drivers.usrp.uhd_manifest import (
     HANDLE_METHOD_RETURN_TYPES,
@@ -39,7 +41,6 @@ from .device_manager import (
 from .v2_errors import (
     RemoteRFNativeUHDError,
     RemoteRFOverloadError,
-    RemoteRFPolicyError,
     RemoteRFProtocolError,
     RemoteRFReservationError,
     RemoteRFServerOverloadedError,
@@ -466,7 +467,6 @@ class DeviceSession:
     gid: int
     schema: Any
     schema_v2: dict
-    policy: USRPPolicy
     root_handle: str
     capabilities: dict
     handles: dict[str, HandleEntry] = field(default_factory=dict)
@@ -569,10 +569,7 @@ class SessionManager:
                     "the USRP is already open through a legacy v1 session"
                 )
             live_schema = create()
-            policy = USRPPolicy.load(gid=gid, serial=context.get("ident", ""))
-            capabilities = live_schema.get_capabilities_v2(
-                policy_restrictions=policy.restrictions
-            )
+            capabilities = live_schema.get_capabilities_v2()
             capabilities["remote_resource_limits"] = {
                 "maximum_sessions": _MAX_SESSIONS,
                 "maximum_handles_per_session": _MAX_HANDLES_PER_SESSION,
@@ -601,7 +598,6 @@ class SessionManager:
             gid=gid,
             schema=live_schema,
             schema_v2=schema_v2,
-            policy=policy,
             root_handle=root_handle,
             capabilities=capabilities,
         )
@@ -865,10 +861,6 @@ class SessionManager:
                 args,
                 positional_args,
             )
-            policy_args = dict(args)
-            if positional_args:
-                policy_args["__args__"] = positional_args
-            session.policy.check_control(method_name, policy_args)
             native_args = {
                 key: self._resolve_handle_argument(session, value)
                 for key, value in args.items()
@@ -884,7 +876,7 @@ class SessionManager:
                         native_args,
                         positional_args=native_positional,
                     )
-                except (RemoteRFPolicyError, RemoteRFProtocolError):
+                except RemoteRFProtocolError:
                     raise
                 except Exception as exc:
                     raise RemoteRFNativeUHDError(
@@ -953,15 +945,6 @@ class SessionManager:
             except queue.Empty:
                 return (False if mutate_metadata else None), mutations
 
-        if not entry.type_id.endswith(("RXStreamer", "TXStreamer")):
-            policy_args = dict(args)
-            if positional_args:
-                policy_args["__args__"] = positional_args
-            session.policy.check_handle_call(
-                entry.type_id,
-                method_name,
-                policy_args,
-            )
         target = getattr(entry.value, method_name, None)
         if not callable(target):
             raise RemoteRFProtocolError(
@@ -1413,19 +1396,6 @@ class SampleDataV1Servicer(grpc_pb2_grpc.SampleDataV1Servicer):
                     ):
                         if not entry.type_id.endswith("TXStreamer"):
                             raise RemoteRFStaleHandleError("TX data used a non-TX handle")
-                        channels = entry.stream_channels or [0]
-                        rates = []
-                        get_rate = getattr(session.schema.device, "get_tx_rate", None)
-                        if callable(get_rate):
-                            for channel in channels:
-                                rates.append(float(get_rate(channel)))
-                        if not rates or min(rates) <= 0:
-                            raise RemoteRFPolicyError(
-                                "TX sample rate is unavailable for duty-cycle enforcement"
-                            )
-                        session.policy.check_tx_duration(
-                            float(request.sample_count) / min(rates)
-                        )
                         if len(request.payload) != byte_count:
                             raise RemoteRFProtocolError(
                                 "TX payload byte length does not match dtype/shape"

{remoterf_server-1.0.4 → remoterf_server-1.0.5}/src/remoteRF_server.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: remoteRF-server
-Version: 1.0.4
+Version: 1.0.5
 Summary: RemoteRF server-side control package
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
@@ -329,36 +329,10 @@ devices:
       serial: 31A2B3C
 ```
 
-Transmit is denied if `~/.config/remoterf/usrp_policy.yml` is missing,
-unreadable, invalid, or does not explicitly enable and bound the requested
-operation. Low-level writes are also denied unless both globally enabled and
-method/path/address allowlisted. A starting policy looks like:
-
-```yaml
-defaults:
-  tx_enabled: false
-  low_level_write_enabled: false
-
-devices:
-  "31A2B3C":
-    tx_enabled: true
-    tx_frequency_ranges_hz:
-      - [902000000, 928000000]
-    max_tx_gain_db: 20
-    max_tx_normalized_gain: 0.5
-    max_tx_power_dbm: -10
-    max_tx_bandwidth_hz: 2000000
-    max_tx_sample_rate_sps: 2000000
-    allowed_tx_antennas: [TX/RX]
-    max_burst_seconds: 1.0
-    max_duty_cycle: 0.1
-    duty_cycle_window_seconds: 60
-    low_level_write_enabled: false
-    low_level_write_methods: []
-    gpio_write_masks: {}
-    property_write_paths: []
-    register_write_addresses: []
-```
+All USRP operations exposed by the Dynamic v2 schema are available without a
+separate policy file. This includes transmit controls, transmit streaming,
+GPIO/register methods, and property-tree writes. `usrp_policy.yml` is not read
+or required by the current server.
 
 On every qualified target, generate the introspection record and enforce the
 pinned API gate:

{remoterf_server-1.0.4 → remoterf_server-1.0.5}/tests/test_dynamic_v2.py

@@ -29,7 +29,6 @@ from remoteRF_server.server.dynamic_v2 import (
 )
 from remoteRF_server.server.v2_errors import (
     RemoteRFOverloadError,
-    RemoteRFPolicyError,
     RemoteRFProtocolError,
     RemoteRFServerOverloadedError,
     RemoteRFSessionExpiredError,
@@ -241,76 +240,19 @@ class DynamicV2ServerTests(unittest.TestCase):
         )
         self.assertEqual(rejected.error.code, "RemoteRFProtocolError")
 
-    def test_policy_denies_tx_by_default_and_enforces_configured_limits(self):
-        denied = USRPPolicy({})
-        with self.assertRaises(RemoteRFPolicyError):
-            denied.check_control("set_tx_freq", {"tune_request": 915e6})
-        with self.assertRaises(RemoteRFPolicyError):
-            denied.check_control("set_normalized_tx_gain", {"gain": 0.1})
-        with self.assertRaises(RemoteRFPolicyError):
-            denied.check_control("set_gpio_attr", {})
-
-        policy = USRPPolicy(
-            {
-                "tx_enabled": True,
-                "tx_frequency_ranges_hz": [[900e6, 930e6]],
-                "max_tx_gain_db": 20,
-                "max_tx_sample_rate_sps": 2e6,
-                "max_burst_seconds": 1.0,
-                "max_duty_cycle": 0.1,
-                "duty_cycle_window_seconds": 60,
-            }
-        )
-        policy.check_control("set_tx_freq", {"tune_request": 915e6})
-        policy.check_control("set_tx_gain", {"gain": 19})
-        with self.assertRaises(RemoteRFPolicyError):
-            policy.check_control("set_tx_freq", {"tune_request": 2.4e9})
-        with self.assertRaises(RemoteRFPolicyError):
-            policy.check_control("set_tx_gain", {"gain": 21})
-
-        normalized = USRPPolicy(
-            {
-                "tx_enabled": True,
-                "max_tx_normalized_gain": 0.5,
-            }
-        )
-        normalized.check_control("set_normalized_tx_gain", {"gain": 0.5})
-        with self.assertRaises(RemoteRFPolicyError):
-            normalized.check_control("set_normalized_tx_gain", {"gain": 0.6})
-
-        low_level = USRPPolicy(
-            {
-                "low_level_write_enabled": True,
-                "low_level_write_methods": ["set_gpio_attr", "set"],
-                "gpio_write_masks": {"FP0": 0x03},
-                "property_write_paths": ["/mboards/0/user"],
-            }
-        )
-        low_level.check_control(
-            "set_gpio_attr",
-            {"bank": "FP0", "mask": 0x03},
-        )
-        with self.assertRaises(RemoteRFPolicyError):
-            low_level.check_control(
-                "set_gpio_attr",
-                {"bank": "FP0", "mask": 0x04},
-            )
-        with self.assertRaises(RemoteRFPolicyError):
-            low_level.check_control(
-                "set_gpio_attr",
-                {"bank": "FP0"},
-            )
-        low_level.check_handle_call(
+    def test_policy_compatibility_shim_allows_all_operations(self):
+        policy = USRPPolicy({"tx_enabled": False, "max_tx_gain_db": 0})
+        self.assertTrue(policy.tx_enabled)
+        self.assertEqual(policy.restrictions, {})
+        policy.check_control("set_tx_freq", {"tune_request": 2.4e9})
+        policy.check_control("set_tx_gain", {"gain": 100})
+        policy.check_control("set_gpio_attr", {"bank": "FP0", "mask": 0xFFFFFFFF})
+        policy.check_tx_duration(3600)
+        policy.check_handle_call(
             "uhd.property_tree",
             "set",
-            {"__args__": ["/mboards/0/user/value", 1]},
+            {"__args__": ["/mboards/0/unsafe", 1]},
         )
-        with self.assertRaises(RemoteRFPolicyError):
-            low_level.check_handle_call(
-                "uhd.property_tree",
-                "set",
-                {"__args__": ["/mboards/0/unsafe", 1]},
-            )
 
     def test_sessions_use_opaque_typed_generation_checked_handles(self):
         inventory = FakeInventorySchema()
@@ -344,6 +286,20 @@ class DynamicV2ServerTests(unittest.TestCase):
             self.assertTrue(session.session_id.startswith("sess_"))
             self.assertTrue(session.root_handle.startswith("dev_"))
             self.assertNotIn("rx:1", session.root_handle)
+            manager.invoke(
+                session.session_id,
+                session.root_handle,
+                "set_tx_freq",
+                {"tune_request": 2.4e9},
+                overload_id="default",
+            )
+            manager.invoke(
+                session.session_id,
+                session.root_handle,
+                "set_gpio_attr",
+                {"bank": "FP0", "attr": "OUT", "value": 1},
+                overload_id="default",
+            )
             result, _ = manager.invoke(
                 session.session_id,
                 session.root_handle,
@@ -413,15 +369,22 @@ class DynamicV2ServerTests(unittest.TestCase):
                 overload_id="default",
             )
             self.assertEqual(value, 3)
-            with self.assertRaises(RemoteRFPolicyError):
-                manager.invoke(
-                    session.session_id,
-                    prop["__remoterf_handle__"],
-                    "set",
-                    {},
-                    positional_args=[4],
-                    overload_id="default",
-                )
+            manager.invoke(
+                session.session_id,
+                prop["__remoterf_handle__"],
+                "set",
+                {},
+                positional_args=[4],
+                overload_id="default",
+            )
+            updated, _ = manager.invoke(
+                session.session_id,
+                prop["__remoterf_handle__"],
+                "get",
+                {},
+                overload_id="default",
+            )
+            self.assertEqual(updated, 4)
             with self.assertRaises(RemoteRFProtocolError):
                 manager.invoke(
                     session.session_id,

remoterf_server-1.0.4/src/remoteRF_server/drivers/usrp/policy.py

@@ -1,363 +0,0 @@
-"""Server-owned USRP policy enforcement.
-
-Missing, unreadable, or incomplete policy files intentionally deny TX and
-low-level writes.  Read-only control and RX remain available.
-"""
-from __future__ import annotations
-
-import os
-import time
-from collections import deque
-from pathlib import Path
-from typing import Any, Mapping
-
-from ...server.v2_errors import RemoteRFPolicyError
-
-try:
-    import yaml
-except ImportError:  # pragma: no cover - deployment dependency, deny-safe fallback
-    yaml = None
-
-
-def default_policy_path() -> Path:
-    root = Path(
-        os.getenv(
-            "REMOTERF_CONFIG_DIR",
-            Path(os.getenv("XDG_CONFIG_HOME", Path.home() / ".config")) / "remoterf",
-        )
-    )
-    return root / "usrp_policy.yml"
-
-
-def _inside_ranges(value: float, ranges) -> bool:
-    for entry in ranges or ():
-        try:
-            low, high = float(entry[0]), float(entry[1])
-        except (TypeError, ValueError, IndexError):
-            continue
-        if low <= float(value) <= high:
-            return True
-    return False
-
-
-def _argument(args: Mapping[str, Any], *names: str, position: int | None = None):
-    for name in names:
-        if name in args:
-            return args[name]
-    positional = args.get("__args__", ())
-    if position is not None and isinstance(positional, (list, tuple)):
-        if 0 <= position < len(positional):
-            return positional[position]
-    return None
-
-
-class USRPPolicy:
-    def __init__(self, config: Mapping[str, Any] | None = None, *, source: str = ""):
-        self.config = dict(config or {})
-        self.source = source
-        self._tx_history: deque[tuple[float, float]] = deque()
-
-    @classmethod
-    def load(cls, *, gid: int, serial: str = "", path: Path | None = None) -> "USRPPolicy":
-        path = path or default_policy_path()
-        if yaml is None or not path.exists():
-            return cls({}, source=str(path))
-        try:
-            raw = yaml.safe_load(path.read_text(encoding="utf-8")) or {}
-            if not isinstance(raw, Mapping):
-                raise TypeError("policy root must be a mapping")
-            defaults = dict(raw.get("defaults") or {})
-            devices = dict(raw.get("devices") or {})
-            selected = devices.get(str(gid)) or devices.get(serial) or {}
-            merged = dict(defaults)
-            merged.update(dict(selected or {}))
-        except Exception:
-            return cls({}, source=str(path))
-        return cls(merged, source=str(path))
-
-    @property
-    def tx_enabled(self) -> bool:
-        return self.config.get("tx_enabled") is True
-
-    @property
-    def restrictions(self) -> dict[str, Any]:
-        return {
-            "tx_enabled": self.tx_enabled,
-            "tx_frequency_ranges_hz": self.config.get("tx_frequency_ranges_hz", []),
-            "max_tx_gain_db": self.config.get("max_tx_gain_db"),
-            "max_tx_power_dbm": self.config.get("max_tx_power_dbm"),
-            "max_tx_bandwidth_hz": self.config.get("max_tx_bandwidth_hz"),
-            "max_tx_sample_rate_sps": self.config.get("max_tx_sample_rate_sps"),
-            "allowed_tx_antennas": self.config.get("allowed_tx_antennas", []),
-            "max_burst_seconds": self.config.get("max_burst_seconds"),
-            "max_duty_cycle": self.config.get("max_duty_cycle"),
-            "low_level_write_enabled": self.config.get("low_level_write_enabled") is True,
-            "low_level_write_methods": self.config.get("low_level_write_methods", []),
-        }
-
-    def _require_tx(self) -> None:
-        if not self.tx_enabled:
-            raise RemoteRFPolicyError(
-                "USRP transmit is disabled until an administrator configures usrp_policy.yml",
-                details={"policy_source": self.source},
-            )
-
-    def check_control(self, method: str, args: Mapping[str, Any]) -> None:
-        if (
-            method.startswith("set_tx_")
-            or method == "set_normalized_tx_gain"
-            or method == "send_waveform"
-        ):
-            self._require_tx()
-
-        if method in {"set_tx_freq", "set_tx_lo_freq", "send_waveform"}:
-            value = _argument(
-                args,
-                "tune_request",
-                "freq",
-                "frequency",
-                position=0,
-            )
-            if isinstance(value, Mapping):
-                value = value.get("target_freq", value.get("freq"))
-            ranges = self.config.get("tx_frequency_ranges_hz") or []
-            if value is None or not ranges or not _inside_ranges(float(value), ranges):
-                raise RemoteRFPolicyError(
-                    f"TX frequency is outside the configured policy ranges",
-                    details={"method": method, "requested_hz": value, "allowed_ranges_hz": ranges},
-                    method=method,
-                )
-
-        if method == "set_tx_gain":
-            limit = self.config.get("max_tx_gain_db")
-            value = _argument(args, "gain", position=0)
-            if limit is None or value is None or float(value) > float(limit):
-                raise RemoteRFPolicyError(
-                    "TX gain exceeds or lacks an administrator limit",
-                    details={"requested_db": value, "maximum_db": limit},
-                    method=method,
-                )
-
-        if method == "set_normalized_tx_gain":
-            limit = self.config.get("max_tx_normalized_gain")
-            value = _argument(args, "gain", position=0)
-            if limit is None or value is None or float(value) > float(limit):
-                raise RemoteRFPolicyError(
-                    "normalized TX gain exceeds or lacks an administrator limit",
-                    details={"requested": value, "maximum": limit},
-                    method=method,
-                )
-
-        if method == "set_tx_power_reference":
-            limit = self.config.get("max_tx_power_dbm")
-            value = _argument(args, "power_dbm", "power", position=0)
-            if limit is None or value is None or float(value) > float(limit):
-                raise RemoteRFPolicyError(
-                    "TX power reference exceeds or lacks an administrator limit",
-                    details={"requested_dbm": value, "maximum_dbm": limit},
-                    method=method,
-                )
-
-        if method == "set_tx_bandwidth":
-            limit = self.config.get("max_tx_bandwidth_hz")
-            value = _argument(args, "bandwidth", position=0)
-            if limit is None or value is None or float(value) > float(limit):
-                raise RemoteRFPolicyError(
-                    "TX bandwidth exceeds or lacks an administrator limit",
-                    details={"requested_hz": value, "maximum_hz": limit},
-                    method=method,
-                )
-
-        if method == "set_tx_rate":
-            limit = self.config.get("max_tx_sample_rate_sps")
-            value = _argument(args, "rate", position=0)
-            if limit is None or value is None or float(value) > float(limit):
-                raise RemoteRFPolicyError(
-                    "TX sample rate exceeds or lacks an administrator limit",
-                    details={"requested_sps": value, "maximum_sps": limit},
-                    method=method,
-                )
-
-        if method == "set_tx_antenna":
-            allowed = {
-                str(value)
-                for value in (self.config.get("allowed_tx_antennas") or ())
-            }
-            antenna = str(_argument(args, "antenna", position=0) or "")
-            if not allowed or antenna not in allowed:
-                raise RemoteRFPolicyError(
-                    "TX antenna is not in the administrator allowlist",
-                    details={"requested": antenna, "allowed": sorted(allowed)},
-                    method=method,
-                )
-
-        if method == "set_tx_lo_source":
-            allowed = {
-                str(value)
-                for value in (self.config.get("allowed_tx_lo_sources") or ())
-            }
-            source = str(_argument(args, "source", position=0) or "")
-            if not allowed or source not in allowed:
-                raise RemoteRFPolicyError(
-                    "TX LO source is not in the administrator allowlist",
-                    details={"requested": source, "allowed": sorted(allowed)},
-                    method=method,
-                )
-
-        if (
-            method == "set_tx_lo_export_enabled"
-            and bool(_argument(args, "enabled", "enable", position=0))
-            and self.config.get("allow_tx_lo_export") is not True
-        ):
-            raise RemoteRFPolicyError(
-                "TX LO export is disabled by administrator policy",
-                method=method,
-            )
-
-        if (
-            method == "set_rx_lo_export_enabled"
-            and bool(_argument(args, "enabled", "enable", position=0))
-            and self.config.get("allow_rx_lo_export") is not True
-        ):
-            raise RemoteRFPolicyError(
-                "RX LO export is disabled by administrator policy",
-                method=method,
-            )
-
-        if method == "send_waveform":
-            self.check_control(
-                "set_tx_rate",
-                {"rate": _argument(args, "rate", position=3)},
-            )
-            self.check_control(
-                "set_tx_gain",
-                {"gain": _argument(args, "gain", position=5)},
-            )
-            self.check_tx_duration(
-                float(_argument(args, "duration", position=1) or 0.0)
-            )
-
-        if method in {
-            "set_gpio_attr", "set_gpio_src", "set_user_register",
-            "set_rx_filter", "set_tx_filter",
-        }:
-            self._check_low_level_write("", method, args)
-
-    def check_tx_duration(self, duration: float) -> None:
-        self._require_tx()
-        if duration < 0:
-            raise RemoteRFPolicyError("TX duration cannot be negative")
-        maximum = self.config.get("max_burst_seconds")
-        try:
-            maximum_value = float(maximum)
-        except (TypeError, ValueError):
-            maximum_value = -1.0
-        if maximum_value < 0 or duration > maximum_value:
-            raise RemoteRFPolicyError(
-                "TX duration exceeds or lacks an administrator limit",
-                details={"requested_seconds": duration, "maximum_seconds": maximum},
-            )
-
-        try:
-            window = float(self.config.get("duty_cycle_window_seconds", 60.0))
-        except (TypeError, ValueError):
-            window = 0.0
-        fraction = self.config.get("max_duty_cycle")
-        try:
-            fraction_value = float(fraction)
-        except (TypeError, ValueError):
-            fraction_value = -1.0
-        if window <= 0 or not 0 <= fraction_value <= 1:
-            raise RemoteRFPolicyError("TX duty-cycle policy is not configured")
-        now = time.monotonic()
-        while self._tx_history and self._tx_history[0][0] < now - window:
-            self._tx_history.popleft()
-        used = sum(item[1] for item in self._tx_history)
-        if used + duration > window * fraction_value:
-            raise RemoteRFPolicyError(
-                "TX duty-cycle limit would be exceeded",
-                details={"window_seconds": window, "maximum_fraction": fraction},
-            )
-        self._tx_history.append((now, duration))
-
-    def check_handle_call(self, type_id: str, method: str, args: Mapping[str, Any]) -> None:
-        """Keep returned low-level interfaces read-only unless allowlisted."""
-        read_prefixes = ("get", "read", "list", "exists", "to_", "peek")
-        if (
-            method.startswith(read_prefixes)
-            or method.startswith("access_")
-            or method in {"access", "subtree"}
-        ):
-            return
-        self._check_low_level_write(type_id, method, args)
-
-    def _check_low_level_write(
-        self,
-        type_id: str,
-        method: str,
-        args: Mapping[str, Any],
-    ) -> None:
-        allowed = set(self.config.get("low_level_write_methods") or ())
-        if self.config.get("low_level_write_enabled") is not True or method not in allowed:
-            raise RemoteRFPolicyError(
-                f"{type_id}.{method} is not allowlisted for low-level writes",
-                details={"type_id": type_id, "method": method},
-                method=method,
-            )
-
-        if method == "set_gpio_attr":
-            bank = str(args.get("bank", ""))
-            mask = _argument(args, "mask", position=3)
-            requested_mask = int((1 << 32) - 1 if mask is None else mask)
-            allowed_mask = int(
-                dict(self.config.get("gpio_write_masks") or {}).get(bank, 0)
-            )
-            if requested_mask & ~allowed_mask:
-                raise RemoteRFPolicyError(
-                    "GPIO write mask exceeds the administrator allowlist",
-                    details={
-                        "bank": bank,
-                        "requested_mask": requested_mask,
-                        "allowed_mask": allowed_mask,
-                    },
-                    method=method,
-                )
-
-        path_value = _argument(
-            args,
-            "path",
-            "property_path",
-            "key",
-            position=0,
-        )
-        path = str(path_value) if path_value is not None else ""
-        if path:
-            allowed_paths = tuple(
-                str(value)
-                for value in (self.config.get("property_write_paths") or ())
-            )
-            if not allowed_paths or not any(
-                path == prefix or path.startswith(prefix.rstrip("/") + "/")
-                for prefix in allowed_paths
-            ):
-                raise RemoteRFPolicyError(
-                    "property-tree write path is not allowlisted",
-                    details={"path": path, "allowed_paths": list(allowed_paths)},
-                    method=method,
-                )
-
-        if method in {"poke32", "poke64", "write_register", "set_user_register"}:
-            address = _argument(args, "addr", "address", position=0)
-            allowed_addresses = {
-                int(value, 0) if isinstance(value, str) else int(value)
-                for value in (self.config.get("register_write_addresses") or ())
-            }
-            if address is None or int(address) not in allowed_addresses:
-                raise RemoteRFPolicyError(
-                    "register write address is not allowlisted",
-                    details={
-                        "address": address,
-                        "allowed_addresses": sorted(allowed_addresses),
-                    },
-                    method=method,
-                )