﻿CJIT Radio Gateway Connector v1.0.0

INSTALL
Extract the complete ZIP and run Install.cmd. Installation is for the current Windows user and compiles the included C# source using the installed .NET Framework compiler. Microsoft Edge and .NET Framework 4.8 are required. No third-party executable is downloaded.

SET UP
1. Unlock /admin in RadioLink, then open /gateway.
2. In Keys & Pairing create a Receive source key, selecting exactly one radio resource.
3. Open CJIT Radio Gateway Connector. Enter the gateway HTTPS base address and rlrx_ key. Save encrypted.
4. Check HTTPS. Open audio window. Select the approved radio USB/accessory or isolated line-audio interface and press Start receive relay.
5. At a separate authorized dispatcher PC, open /receiver, /radio or /gateway/listen and choose Listen for that source.

SECURITY AND BEHAVIOR
The saved key uses Windows DPAPI CurrentUser encryption. It can only be decrypted under that Windows user's credentials, but software running as that same user can access it. Browser pairing uses a single-use 60-second ticket. The long-lived key is not placed in a URL or browser storage. The temporary ticket appears in the initial Edge launch fragment and is removed by the page after exchange. Paired browser sessions last eight hours.

The Windows controller and the Edge audio window must run in an interactive signed-in user session. This is not a Session 0 Windows service. Closing the controller minimizes it to the tray; Stop and exit requests source shutdown. Keep the Edge audio window open while publishing. Input capture requires an explicit Start click and browser permission. Stop the old relay before changing a connection/key. Reopening repeatedly creates additional bounded pairing sessions; revoke/reissue a key if sessions are lost.

The source sends a heartbeat every five seconds. Its server lease expires after 25 seconds; source/listener clients stop on lost authorization or prolonged gateway failure. A synthetic test tone is clearly labeled and does not represent radio traffic. The gateway stores signaling and audit metadata; this connector does not record audio.

NETWORK CHECKS
Run Test-Gateway.ps1 with your HTTPS base address. It verifies DNS, actual TCP 443 connectivity, the gateway health contract, Edge presence, driver inventory and effective firewall profile defaults. These checks do not prove UDP, TURN authentication, received audio or hardware operation.

No inbound listener or automatic firewall rule is installed. A restrictive outbound firewall/NAT may require TURN/TLS on port 443. Configure-Firewall.ps1 previews narrow outbound Edge rules to current resolved gateway/STUN/TURN addresses; applying requires -Apply in elevated PowerShell. It never disables the firewall. DNS changes may require updating rules. Direct peer media also requires its negotiated UDP path, so use the actual receive test rather than assuming connectivity.

LIMITS / ACCEPTANCE
Receive-only audio, up to eight listeners per source and four feeds per position. No RF transmit, over-the-air P25 decoding, proprietary CSSI/DFSI/ISSI interface, hardware PTT, physical lock control or pma-voice audio patch is included. A suitable radio, approved interface/cable, programming and operating permissions remain required. Browser group voice uses the separately configured provider.

Test real input levels, headset playback, independent networks/TURN, key revocation, cable removal, network loss, source stop, computer restart and an eight-hour session boundary before relying on an installation. Windows installation and physical-radio acceptance must be executed on the actual equipment.
