Monolith Manual

The Icebox Monolith is a self-hosted, multi-service studio and event management platform running on an Orange Pi 5 Plus (RK3588 · 8 GB RAM). It operates as a Docker Swarm stack with 27 services behind an nginx reverse proxy, accessible via Tailscale Funnel at orangepi5-plus.tail8c906d.ts.net.

Architecture at a Glance

• ›Portal — Next.js 14 front-end, port 3000. All browser-facing pages.
• ›19 specialised AI agents — FastAPI Python services, each specialising in a domain.
• ›Nginx — Routes /api/*, /admin, /repair, and all portal paths.
• ›Gatekeeper (007) — Security audit agent; also manages API tokens.
• ›Forge — Hardware sentinel: temperature, memory, disk telemetry.
• ›Yabo — Host OS agent (systemd). Manages the machine outside Docker.

Admin Override PIN

PIN XXXXXX bypasses authentication on every protected portal page (Runner, Tenant, Admin). Type it into the password/key field and submit — no username required.

API Tokens

Tokens beginning with ice_ can be entered in any protected login field as an alternative to a staff key. See the API Tokens section for how to issue them.

The Orange Pi 5 Plus has 8 GB of RAM. The full Monolith stack uses approximately 3–4 GB under normal operation. Several optimisations are in place to prevent memory exhaustion.

XTTS Voice Synthesis

XTTSv2 (neural TTS) is disabled by default (XTTS_ENABLED=falsein the IVR environment). Loading XTTSv2 requires 4–6 GB of RAM — enough to crash the system on an 8 GB board. When disabled, the IVR falls back to SignalWire's built-in TTS. To enable: set XTTS_ENABLED=true in /home/ice/.env.

Whisper Speech Recognition

The Whisper model (~700 MB) is unloaded from memory immediately after each transcription. gc.collect() and torch.cuda.empty_cache() are called after every use. This keeps the IVR's steady-state RAM at under 100 MB between calls.

Service Memory Limits

• ›IVR — 1.5 GB limit (XTTS disabled) / 256 MB reservation.
• ›Echo — 3 GB limit / 512 MB reservation.
• ›Siren — 2 GB limit / 256 MB reservation.
• ›Beats — 512 MB limit (music gen disabled) / 128 MB reservation.
• ›All other services — 256–512 MB limits.

Forge Autonomous Healing

When available RAM drops below 10 %, Forge automatically drops the Linux page cache and prunes stopped Docker containers. See the Forge Sentinel section for full details.

Master Image

A master image snapshot is kept at /mnt/master_vault/models/MASTER_IMAGE/. The two most recent images are retained — giving you one rollback version at all times. Images older than the previous version are pruned after each build. Run sudo monolith-master-image to rebuild.

The home page at / is the public-facing live stream hub. It shows the HLS video player, a scrolling banner carousel, and quick links to all sub-portals.

First Visit — Terms Modal

First-time visitors see a Terms of Access modal. Accepting stores a flag in localStorage — the modal will not appear again on the same browser.

Venue Assist

The Venue Assist button places an automated call via the IVR to the studio. The caller ID is the Monolith's SignalWire number. Use it for on-the-floor support requests.

Access Portals Panel

• ›Fan Zone — Live cam and merch drop.
• ›Studio Access — Tenant dashboard for booked clients.
• ›Staff Operations — Runner task board for staff.

Public page at /fan. Requires no login. Shows the live stream, real-time viewer count, session info, and the merch drop panel.

Live Stream

Powered by the Optic agent (port 8010). If the stream is offline the player shows a placeholder. Optic handles HLS encoding via OBS/FFmpeg running on the host.

Intro Music Player

The ▶ PLAY INTRO button (bottom-right, all pages) plays a random track from the 17-song intro playlist. When a song ends the player automatically picks a different random track and continues — no restart needed. Clicking ⏸ INTRO pauses playback; clicking again resumes from the same position. Playback state is saved to localStorage and restored on page reload within 5 minutes.

Bimodal Toggle

The toggle in the top-right of the Fan Zone switches the audio engine between two playback modes managed by the Echo and Vibe agents. Mode A is standard stereo; Mode B routes through spatial/DSP processing.

Merch Drop

Items shown are pulled from the Fan agent (port 8003). Inventory is managed via the admin dashboard. Shop links route to the configured e-commerce endpoint.

Public booking inquiry form at /booking. Submits to the Booking agent (port 8005), which logs the inquiry and triggers a follow-up workflow.

Event Types Supported

• ›Recording Session
• ›Video Studio Session
• ›Live Streaming
• ›Music Video Production
• ›Podcast / Interview
• ›Corporate Event · Private Event · Album Release Party

IVR Deep Links

When callers request an emailed link from the IVR, they receive a URL with the event type pre-selected so the form opens ready to fill:

• ›Music Studio callers → /booking?type=Recording+Session
• ›Video Studio callers → /booking?type=Video+Studio+Session

After Submission

The team is notified and will respond within 24 hours. If the form fails, call the studio directly.

Confirmation

A green confirmation screen replaces the form on success. The "Submit Another" button resets the form for a second inquiry.

Protected page at /tenant. Clients with a booked session use this to view their schedule, session time remaining, and billing summary.

Logging In

• ›Enter your Tenant ID (e.g. TENANT-001) and the 6-digit access key delivered via IVR.
• ›Admin PIN XXXXXX — type in the Key field, Tenant ID field can be anything.
• ›ice_ tokens — paste your issued API token into the Key field.

Dashboard Panels

• ›Studio Status — Real-time availability from the Tenant agent (port 8002).
• ›Hours Remaining — Countdown against your booked block.
• ›Upcoming Bookings — Next two confirmed sessions with room and time.
• ›Account — Current balance, last payment, and hourly rate.

Getting Your Access Key

Call XXX-XXX-XXXX. The IVR will ask for your Tenant ID and deliver a one-time 6-digit key.

Staff-only page at /runner. Displays the live task board for runners, dispatchers, and logistics personnel.

Logging In

• ›Staff key issued by management — enter in the password field and submit.
• ›Admin PIN XXXXXX grants immediate access.
• ›ice_ tokens — paste your issued API token.

Task Board

Tasks are pulled from the Runner agent (port 8004) every 30 seconds. Filter by status using the tab bar at the top.

Task Statuses

• ›Active — In progress right now.
• ›Pending — Queued, not yet started.
• ›Done — Completed this session.
• ›Blocked — Cannot proceed; requires attention.

Priority Levels

• ›High — Time-critical; handle immediately.
• ›Normal — Standard priority.
• ›Low — When capacity allows.

Map

The Venue Map panel (powered by Leaflet) shows location pins for active tasks within the facility. Tap a pin for task details.

Internal dashboard at /admin. This is the operations command center — sandbox routing, token issuance, hardware telemetry, agent grid, terminal feed, and G-Code generator.

Ops Tools — Sandbox Control

First panel visible at the top of the Control Center. Controls the IVR test line +1 (888) 744-1663. When a service is set, callers who dial that number get their own private Docker container for that service — Forge provisions it on the fly and SMS's a unique session URL to the caller's phone. The container stays active until they log out (24-hour hard limit).

• ›State badge — green LIVE means real callers; gold service name means test routing is active and new callers get a sandbox.
• ›Activate Overlay — select a service and click to route the test line. Subsequent callers each get an isolated container for that service.
• ›Reset to LIVE — returns the test number to normal production routing immediately.

Sandbox — How Tester Containers Work

Each tester session is a standalone Docker container. The container type depends on the service:

• ›Biff sandbox — Full proxy to production Biff. Testers can build and save projects normally (work lands on the paid account); downloads are blocked with a "Paid Plan Required" page. Gold banner across the top.
• ›Repair sandbox — Full proxy to production Repair. Bottom simulator bar lets testers inject problems (disk pressure, corrupt config, CPU spike, etc.) and deploy the repair swarm inside the sandbox to fix them. Download and live-deploy endpoints are blocked. Purple banner.
• ›All other services — Session landing page with a Testing Checklist and elapsed-time counter. Use the End Session button to close cleanly.
• ›Forge Pipeline — Every sandbox overlay automatically catches JS errors, XHR/fetch HTTP errors, and surfaces a floating 💬 feedback panel. Tester notes (bug reports, suggestions, general notes) email the owner immediately with service name and session token. Repeated auto-errors (3+ of the same type within 10 minutes) trigger a threshold alert email.

Ops Tools — Token Generator

Second panel at the top of the Control Center. Issues ice_ API tokens for any service in the monolith without needing to touch the Gatekeeper API directly.

• ›Select the target service (ivr, portal, fan, booking, broker, runner, tenant, forge, etc.).
• ›Optionally edit the label — auto-filled with the service ID.
• ›Choose duration: 1d, 7d, 30d, 90d, 180d, or 365d.
• ›Click Generate Token — the ice_ token appears with a one-click copy button and human-readable expiry.

System Health Bar

• ›CPU Temp — RK3588 core temperature via Forge. Alert threshold: 75 °C.
• ›RAM — Used / total memory. Polled every 15 s.
• ›Disk — Root filesystem utilisation.
• ›Agents Online — Count of agents responding to health checks.

Agent Grid

Shows all 14 agents with live online/offline status badges. Click any agent tile to open its dedicated page or API explorer.

Terminal Feed

Real-time WebSocket event log from the Admin service (port 8014). Shows service status changes, drag-and-drop transfer events, and command outputs.

Wake-Word Status

Shows whether the Echo agent's wake-word listener is armed. When armed, saying the trigger phrase activates voice command mode on the host.

G-Code Generator

See the G-Code Generator section below.

Studio Binaries

The Studio Binaries panel lists seven host-level studio and telephony tools with their installation status and file sizes:

• ›jackd — JACK Audio Connection Kit daemon
• ›ardour — Professional DAW
• ›lmms — Linux MultiMedia Studio
• ›obs — OBS Studio (streaming/recording)
• ›kdenlive — Video editor
• ›shotcut — Video editor
• ›asterisk — PBX / telephony engine

Why binaries showed "missing"

The Admin service runs inside a Docker container — it has its own isolated filesystem and cannot see the host's /usr/bin, /usr/local/bin, or /usr/sbin by default. Path lookups like /usr/bin/obs would fail even when obs is installed on the host, causing every binary to report as missing.

The fix was adding read-only bind mounts in docker-compose.yml so host directories are exposed inside the container at a /host/ prefix:

• ›/usr/bin → /host/usr/bin
• ›/usr/local/bin → /host/usr/local/bin
• ›/usr/sbin → /host/usr/sbin

The binary paths in admin/main.py were updated to match (e.g. /host/usr/bin/obs). All seven binaries now report present.

Note: jackd and ardour are symlinks pointing to /mnt/master_vault/usr/bin/. Their reported size will show 0.0 MB because Path.stat() returns the symlink size, not the target. This is cosmetic — the binaries are present and functional.

Internal dashboard at /007. The central security and integrity console for the Monolith — webhook validation, bearer token management, rate limiting, audit logging, settlement ledger integrity, and root-level override authority.

Vault Bridge

Shows whether the integrity bridge between all services is live. Click Run Check to test connections. If the bridge is severed, a Restore button appears — use it to re-establish the link.

God Mode

Root-level override that bypasses all authentication restrictions for a timed window. Activate via IVR passphrase or DTMF code XXXX. Status shows method, activation time, and expiry. God Mode self-expires — it cannot be left on indefinitely.

Admin Session

Tracks the open admin session (call SID and opened time) and voice biometric enrollment status. Enrollment is triggered through the Control Center or via the IVR voice-enrollment prompt.

Settlement Ledger

A hash-chained JSON-LD ledger that records every financial settlement event. Click Verify Chain to check end-to-end integrity. Any break in the chain is reported immediately with the affected entry count.

Audit Log

Scrolling security event log — every authentication attempt, token validation, and webhook check is recorded with IP address, success/failure status, and notes. Auto-refreshes every 30 seconds. Click Refresh to pull immediately.

API Token Management

The Gatekeeper issues and validates ice_ API tokens. See the API Tokens section for full details on issuing, using, and revoking tokens.

The Monolith runs 19 specialised AI agents. Each is a FastAPI Python service.

Health Endpoints

Every agent exposes GET /health returning {"status":"ok"}. The Admin dashboard polls these every 15 seconds via WebSocket heartbeat.

Yabo — Host OS Agent

Yabo runs as a systemd service on the host (outside Docker) at /etc/systemd/system/yabo.service. It manages OS-level tasks, monitors the host, and can reinstate the full Docker stack if Forge goes down. Yabo calls Ollama directly for all AI — no external API, no relay service, no cloud dependency. If Yabo is down: sudo systemctl restart yabo.

Located on the Control Center page (/admin). Converts plain-English CNC descriptions into G-code programs using the AI agent.

How to Use

• ›Type a description of the operation in the text area (e.g. "drill a 10mm hole 5mm deep at X50 Y50").
• ›Press Generate G-Code or use Ctrl + Enter.
• ›The generated code appears in the green monospace output panel below.
• ›Click Copy to copy to clipboard.

What It Can Generate

• ›Drilling cycles (G81/G83) with depth, feed, and retract parameters.
• ›Milling profiles — pockets, contours, facing passes.
• ›Tool change sequences with correct M6 / T commands.
• ›Coordinate system setup: G54–G59 work offsets, G17/G18/G19 planes.
• ›Lathe turning operations with CSS (constant surface speed).

Tips

• ›Specify units ("metric" or "imperial") in your description for correct G20/G21.
• ›Mention material for appropriate feed and speed suggestions.
• ›Always verify generated G-code against your machine's controller before running.

The Repair Swarm is an AI-powered remote diagnostics and auto-repair service (port 8017). A permanent host agent manages sessions; disposable worker clones spawn per connection, run full OS triage, diagnose on the fly, apply file-level corrections, then self-shred. Nothing is left behind on the client machine.

Zero-Friction Download (v9+)

Visit /repair. The page auto-detects your OS and shows a single Download button. No terminal, no copy-paste — just open the file from your Downloads folder:

• ›Windows — IceboxRepair.bat: double-click. Installs Python 3 silently via winget if missing, then connects automatically.
• ›macOS — IceboxRepair.command: double-click (first time: right-click → Open). Terminal opens and the agent starts.
• ›Linux — IceboxRepair.sh: run bash ~/Downloads/IceboxRepair.sh in a terminal.
• ›Android — install Termux (F-Droid), run the one-liner shown on the page inside Termux.

All wrappers download the Python connector from /api/repair/client, run it, then delete it on completion. The connector auto-installs the websockets package silently if missing.

Authorization

The repair page requires the user to check an authorization notice before the Download button activates. This confirms the session owner consents to the remote access. All activity is logged and the agent removes itself on completion.

Session Modes

• ›repair (default) — Wave 1 diagnostics + Wave 2 auto-fixes. Most sessions complete in one or two waves.
• ›map — Full topology scan: OS fingerprint, hardware inventory, all network interfaces, ARP table, open ports, installed software, running services, users, firewall rules. Stored in memory for future sessions on the same host.
• ›deep — Repair + deep scan, crash report analysis, and update check. Includes security audit and persistence checks.

Tool Suite — 26 Tools × 4 OS Types

Every tool has OS-specific commands for Linux, macOS, Windows, and Android. Tools run in waves:

• ›Wave 1 — Diagnostics: sys_info, process_list, disk_health, network_check, event_logs, startup_items, battery_health.
• ›Wave 2 — Auto-Fixes: clear_temp, flush_dns, kill_hung, disk_cleanup.
• ›Wave 3 — Deep Fixes: reset_network, fix_permissions, service_restart.
• ›Deep Tools: deep_scan, crash_report, update_check.
• ›Mapper Tools (9): map_os_fingerprint, map_hardware, map_network_interfaces, map_arp_neighbors, map_open_ports, map_installed_software, map_running_services, map_users, map_firewall.

On-the-Fly Diagnosis and File Corrections

After every diagnostic tool result, the inline fix engine immediately reads, analyzes, and corrects config files on the client — no second wave required for common issues:

• ›DNS failure — reads /etc/resolv.conf; rewrites it with 8.8.8.8 & 1.1.1.1 if nameservers are missing or loopback-only. Backs up the original.
• ›Hostile hosts file — scans /etc/hosts (Linux/macOS) or C:\Windows\System32\drivers\etc\hosts (Windows) for redirects of known-good domains; removes them and saves the clean version.
• ›systemd-resolved — reads /etc/systemd/resolved.conf, patches DNS= to 8.8.8.8 1.1.1.1 if commented out, restarts the service.
• ›Disk full (Linux) — measures /var/log, force-rotates if over 500 MB, truncates individual logs over 100 MB, removes core dumps.
• ›Disk full (macOS) — clears ~/Library/Caches.
• ›Failed systemd services — reads the unit file, verifies the ExecStart binary exists, attempts systemctl reset-failed && start, reports exact error if it fails.
• ›SSH permissions — enforces 700 on ~/.ssh and 600 on keys; flags command-locked authorized_keys entries.
• ›Persistence / malware indicators — scans /etc/crontab, /etc/profile.d/*.sh (Linux), and ~/Library/LaunchAgents/*.plist (macOS) for curl/wget/bash -i/base64 patterns.
• ›fstab integrity — reads /etc/fstab, flags root ext4 mounts missing errors=remount-ro.

Each file correction is sent to the client as a fix_applied message and printed in the terminal. Original files are backed up to <path>.icebox.bak before any write.

Clone Wave Architecture

• ›Host agent is permanent — receives reports, injects memory context into new clones, issues shred confirmations. Never dispatches itself.
• ›Worker clones are fire-and-forget — one per wave, shred themselves when done. Context is injected at dispatch; clones hold nothing themselves.
• ›If a wave finds something it cannot fix, it dispatches a specialist clone with targeted tools and full session context.
• ›Recurring issues across sessions (detected from persistent memory) auto-escalate to a specialist with deep_scan + crash_report + update_check.

Persistent Memory

Every session is stored at /mnt/master_vault/repair_memory.db. The host agent builds a system map per hostname and injects past findings into future sessions — so repeat visits are faster and context-aware. Query via:

• ›GET /repair/memory — all hosts, known fixes, recent sessions.
• ›GET /repair/memory/{hostname} — full context and system map for one host.
• ›GET /repair/maps/{hostname} — stored topology map.

Supported Platforms

• ›Linux — Full suite: systemctl, journalctl, ss, ip, df, free, apt, logrotate, iptables, fstab, cron.
• ›macOS — launchctl, diskutil, dscacheutil, brew, pmset, pfctl, LaunchAgents.
• ›Windows — cmd + PowerShell: wmic, netsh, schtasks, wevtutil, chkdsk, winget, hosts file.
• ›Android (Termux) — getprop, dumpsys, pm, logcat, ip, iptables.

API Reference

• ›WS /repair/ws — primary repair WebSocket (client connector connects here).
• ›GET /repair/health — service status and active session count.
• ›GET /repair/sessions — live session list with wave and findings.
• ›GET /repair/reports — last 100 session reports.
• ›GET /api/repair/windows — download IceboxRepair.bat (public).
• ›GET /api/repair/mac — download IceboxRepair.command (public).
• ›GET /api/repair/linux — download IceboxRepair.sh (public).
• ›GET /api/repair/client — download the raw Python connector (public).

Forge is the hardware sentinel for the Orange Pi 5 Plus. It runs at port 8013 and polls the board every 30 seconds. It is the only service with autonomous call authority — it will call the owner directly when the system needs attention.

Hardware Monitoring

• ›All thermal zones: CPU (A76 big cores), CPU (A55 little cores), GPU, NPU, board sensors.
• ›CPU frequencies on all 8 cores; GPU, NPU, and DDR memory bus governors.
• ›RAM and swap usage; disk utilisation on every mounted filesystem.
• ›Kernel dmesg scan for hardware errors on every poll cycle.

Autonomous Alerts (calls owner)

• ›Any thermal zone exceeds 90 °C → immediate call.
• ›RAM or disk usage exceeds 90 % → immediate call.
• ›New master image built → call with a summary of which services changed versions.
• ›15-minute cooldown per event type to prevent repeated calls.

Autonomous Healing

• ›High memory: drops Linux page cache, prunes stopped Docker containers.
• ›High disk: prunes unused Docker images and stopped containers.
• ›Beats music generator restart skipped when MUSIC_GEN_ENABLED=false.
• ›5-minute cooldown between healing attempts for the same issue.

Active Controls (on command)

• ›Set CPU governor: performance / powersave / ondemand / schedutil.
• ›Trigger thermal emergency — drops board to powersave mode immediately.
• ›Rebuild and redeploy any service in the Docker stack.
• ›Warm up the Whisper speech-to-text model.
• ›Build a new master image snapshot of all running service versions.
• ›Place an immediate outbound call with any custom message.

Disaster Recovery

• ›Run full backup to the 1 TB external drive via monolith-backup.
• ›Check DR backup status and integrity.
• ›Full triage report: hardware + DR status combined.

NVMe Management

Monitors the 256 GB Micron NVMe drive at /mnt/nvme. The NVMe handles /tmp bind, 8 GB swap, and service scratch volumes. Forge can run a full automated repair sequence if the drive degrades.

AI Chat Interface

Forge has a built-in chat at /forge powered by Claude. It can read live hardware state and take corrective actions based on natural language instructions. Available tools: thermal zones, memory, storage, CPU governor, thermal emergency.

API

• ›GET /forge/thermal — all thermal zone readings.
• ›GET /forge/memory — RAM and swap snapshot.
• ›GET /forge/hardware/summary — full board snapshot.
• ›GET /forge/triage — hardware + disaster recovery report.
• ›POST /forge/cpu/governor — set CPU scaling governor.
• ›POST /forge/master-image — trigger master image build.

Professional video and audio post-production at /video-studio. Powered by the Siren agent (port 8016), which runs all processing locally via FFmpeg — no cloud uploads, no latency.

What It Does

• ›Broadcast audio normalisation to -14 LUFS with multiband peak limiting.
• ›Video colour grade — nine visual styles (see below).
• ›Denoising, sharpening, and H.264/AAC export at up to 8 Mbps.
• ›ProRes and WAV-only export modes available.

Automatic Light Filtering

Every video processed through Siren gets automatic light analysis. Siren samples five frames via FFmpeg showinfo, reads luma (Y) and chroma (U/V) channels, and picks the best grade automatically:

• ›Dark scene (Y < 55) → blue_hour
• ›Very bright (Y > 195) → daylight
• ›Warm orange cast → golden_hour
• ›Cool blue cast → cool
• ›Bright neutral → portrait
• ›Green-tinted neutral → fluorescent
• ›Everything else → standard

Prompt Light Filtering

Type a plain-English lighting description in the Siren dashboard and press ↵ MATCH. The style is resolved locally by keyword matching — no API call, no inference. Examples:

• ›"warm golden sunset" → golden_hour
• ›"cool overcast studio" → cool
• ›"cinematic teal film noir" → cinematic
• ›"flattering portrait skin tones" → portrait

Visual Style Reference

• ›standard — Broadcast neutral: contrast +10%, saturation +10%, sharpened.
• ›cinematic — Teal-shadow / warm-highlight curves, filmic desaturation, grain, vignette, 2.39:1 letterbox bars.
• ›warm — Boosted reds, rolled-off blues. Indoor tungsten look.
• ›cool — Lifted blues, pulled reds. Overcast / commercial feel.
• ›daylight — Clean bright outdoor grade: lifted shadows, neutral balance.
• ›golden_hour — Amber-orange highlights, deep shadows. Sunset / magic-hour look.
• ›blue_hour — Deep blue/purple tones, slightly lifted luma. Dusk atmosphere.
• ›portrait — Soft, flattering skin tones, gentle contrast, slight warmth.
• ›fluorescent — Green-cast correction for office/clinic lighting.

Sending the Finished File

After export, click Send Email in the dashboard to send the mastered file to any address via SMTP. Large files are attached directly.

API

• ›POST /siren/ingest — upload media file.
• ›POST /siren/master — start mastering job.
• ›GET /siren/export/{filename} — download finished file.
• ›POST /siren/prompt-filter — match a text description to a style (returns style key).
• ›POST /siren/filter-image — apply a filter to a still image.
• ›POST /siren/analyze-light — return luma/chroma analysis + recommended style.
• ›GET /siren/styles — list all available style keys.
• ›POST /siren/send-email — email an exported file.

A full Photoshop-style image editing workspace at /image-studio. Non-destructive tonal and colour adjustments, crop, transform, resize, history/undo, and live CSS preview — all backed by a high-quality FFmpeg processing pipeline via Siren (port 8013). No cloud — 100% edge-local.

Interface Layout

• ›Menu / toolbar bar — Undo, Redo, zoom controls (+/−/Fit), Before / After / Split toggle, Download button.
• ›Left toolbar — Move (V), Crop (C), Zoom (Z), Hand/Pan (H) tools, plus file open (📂) at the bottom.
• ›Canvas — zoom with scroll wheel, pan with Hand tool drag. Displays live CSS-filter preview instantly as sliders move.
• ›Right panel — Adjustments tab — six collapsible sections: Light, Color, Detail, Effects, Transform, Resize. Apply Adjustments button sends to Siren for FFmpeg-quality output.
• ›Right panel — History tab — full non-destructive history list; click any state to roll back.
• ›Right panel — Info tab — pixel dimensions, format, file size, current filename, keyboard shortcut reference.
• ›Status bar — zoom %, WxH, KB, format, tool name, history position.

Adjustment Sections

• ›Light — Exposure (±5 stops), Contrast, Highlights, Shadows, Whites, Blacks (all ±100).
• ›Color — Temperature, Tint, Saturation, Vibrance, Hue (±100 / ±180).
• ›Detail — Clarity (large-radius unsharp), Sharpness (fine detail), Noise Reduction (hqdn3d).
• ›Effects — Vignette, Blur, Visual Style selector (10 styles), lighting prompt match.
• ›Transform — Rotate CW 90°, CCW 90°, 180°, Flip Horizontal, Flip Vertical.
• ›Resize — enter width and/or height in pixels, optional aspect-ratio lock.

Workflow

• ›Drop a file on the canvas or click 📂 — image uploads to Siren work directory.
• ›Drag sliders — live CSS preview updates the canvas instantly (no server round-trip).
• ›Click Apply Adjustments — Siren runs FFmpeg (eq, curves, unsharp, hqdn3d, vignette, boxblur) for full-quality output; result pushed to history.
• ›Select Crop tool (C), draw a rectangle on the canvas, click Apply — Siren crops to exact pixel bounds. Rule-of-thirds grid shown while dragging.
• ›Use Transform buttons for rotation / flip — each creates a new history entry.
• ›Click any History entry to revert non-destructively.
• ›Click ⬇ Download or email the result from the bottom of the right panel.

Keyboard Shortcuts

• ›V / C / Z / H — Move / Crop / Zoom / Hand tool.
• ›+ / − — zoom in / out. 0 — fit to screen.
• ›Enter — apply crop. Esc — cancel crop.
• ›Ctrl+Z — undo. Ctrl+Shift+Z — redo.
• ›Scroll wheel — zoom in / out on canvas.

Siren API Endpoints Used

• ›/siren/ingest — upload, store to work directory.
• ›/siren/adjust — apply Photoshop-style adjustments via FFmpeg filter chain.
• ›/siren/crop — pixel-accurate crop (FFmpeg crop=w:h:x:y).
• ›/siren/transform — rotate / flip (FFmpeg transpose, hflip, vflip).
• ›/siren/resize — resize with optional aspect-ratio lock (FFmpeg scale).
• ›/siren/image-info/<filename> — ffprobe metadata (dimensions, format, size).
• ›/siren/filter-image — apply a named visual style (same as Video Studio).
• ›/siren/download/<filename> — retrieve processed file.
• ›/siren/send-email — email result as attachment.

Studio Desktop

A full XFCE4 graphical desktop (Kdenlive, Shotcut, OBS, GIMP) is available on demand directly from this page — no VNC client required. The desktop is stopped at boot to save ~150 MB RAM and only runs when you need it.

• ›🖥 Desktop button (top toolbar, right side) — first click starts the VNC session and opens the desktop in a new browser tab via noVNC.
• ›Button turns green when the desktop is running; click again to reopen the tab.
• ›Click the ✕ next to the button to stop the desktop and recover the RAM when you're done.
• ›Desktop is served at /studio/vnc.html through nginx — works over LAN and Tailscale.

Supported Formats

Input: JPG, JPEG, PNG, TIFF, BMP, WebP. Output: same extension as input, high-quality (FFmpeg -q:v 2).

A unified coding and Python learning workspace at /code-studio. Four tabs in one dark IDE-style layout: a live code editor with sandboxed execution, and all three Python classes (101, 201, 301) with their Coach Py AI chat embedded inline.

Tabs

• ›{ } Code Editor — write and run Python, Node.js, or Shell scripts instantly. No login required.
• ›Python 101 — beginner curriculum, lesson progress, certificate workflow, Coach Py chat.
• ›Python 201 — intermediate curriculum (same features).
• ›Python 301 — advanced curriculum (same features).

Code Editor

• ›Select runtime: Python 3.11, Node 20, or Shell (alpine).
• ›Write code in the editor — Tab inserts 4 spaces; Ctrl+Enter runs.
• ›Click ▶ Run — code executes inside an isolated Docker container (no network, 256 MB RAM, 0.5 CPU, 30 s timeout).
• ›stdout and stderr appear in the output panel below. Elapsed time and exit code shown.
• ›History sidebar stores the last 20 runs — click any entry to restore the code.

Python Classes (101 / 201 / 301)

• ›Same lesson accordions, progress tracking, and certificate workflow as the standalone pages.
• ›Ask Coach Py → button on each lesson opens an inline AI chat panel on the right.
• ›Enter your email and click Load to restore progress across sessions.
• ›When all 8 lessons are marked complete, the certificate form appears — generate, download, or email.

Execution Sandbox

Code runs via POST /forge/execute-code. Forge spawns a temporary Docker container using python:3.11-slim, node:20-slim, or alpine:latestwith --network none, --memory 256m, and --cap-drop ALL. Containers are removed immediately after the run (--rm). Maximum 60 seconds.

Biff is the Icebox Monolith AI app factory. Describe your idea in plain language and Biff generates a complete, production-ready application — front end, back end, database, auth, and documentation — with no coding required. You own all the source code. Access Biff from the homepage at /#biff or directly at /biff/. On the IVR, press 8 then 6.

What Biff Builds

• ›Mobile Apps — React Native + Expo (TypeScript strict), iOS & Android, with full navigation, Zustand state management, and JWT auth via Expo SecureStore.
• ›Full Backend — FastAPI + SQLAlchemy 2.0, Pydantic v2 schemas, Alembic migrations, JWT access & refresh tokens, bcrypt password hashing.
• ›Ship-Ready Packaging — eas.json build profiles, App Store & Play Store submission checklists, NSUsageDescriptions, and a complete README.
• ›Web Apps & Games — single-file or multi-file HTML/JS/CSS tools, dashboards, and browser games generated complete and immediately runnable.

How to Use

• ›Navigate to /biff/ or click Get Started → on the homepage Biff card.
• ›Type your idea in the prompt box — be as descriptive as you like. Example: "A habit tracker app with streaks, push reminders, and a leaderboard."
• ›Click Build. Biff streams the generation live — you see each file appear as it is written.
• ›When complete, click Download ZIP to get the full source code. All files are immediately runnable.
• ›Previously built projects appear in the Projects list — click any to browse its files or re-download.

AI Engine

Biff uses Ollama (local) as the sole AI engine — builds run privately on-device with no external API costs or dependencies. All output is streamed in real time via Server-Sent Events.

Pricing

Build with Biff is a paid service. Current pricing is shown live on the homepage Biff card. To add Biff access to your phone number, click Add to My Number on the homepage or visit /telco?upgrade=biff.

Project Storage

All generated projects are saved to the master vault at /mnt/master_vault/biff_projects/. Each project folder contains a meta.json (idea, timestamp, app name) and a files/directory with the complete generated source tree.

An interactive beginner Python course available through the IVR and the web portal. Students work one-on-one with Coach Py, an AI teacher, through eight structured lessons. This is the first course in a three-part track: 101 (Beginner) → 201 (Intermediate) → 301 (Advanced).

Curriculum — 8 Lessons

• ›Lesson 1 — Variables and data types.
• ›Lesson 2 — Strings and string methods.
• ›Lesson 3 — Lists and indexing.
• ›Lesson 4 — Dictionaries and key-value storage.
• ›Lesson 5 — Loops (for and while).
• ›Lesson 6 — Functions and scope.
• ›Lesson 7 — Classes and objects.
• ›Lesson 8 — Error handling and exceptions.

How to Access

• ›Web: visit /python — dedicated Python Class 101 portal with curriculum and pricing.
• ›IVR: call the studio, press 8 for Jiko, then press 3 for Python Coding Class 101.
• ›The IVR reads a full course description, then captures your email and sends you the direct link.

Progress Tracking

Enter your email on the course page and click Load. Click any lesson to mark it complete — progress is saved permanently to the Forge database. Lessons cannot be unmarked once complete.

Certificate of Completion

Complete all 8 lessons and the Claim Your Certificate panel unlocks. Enter your full name, generate the PDF certificate, then download it or have it emailed to you directly. Certificates are issued from the Icebox Monolith and include:

• ›Student name, course title, and issue date.
• ›Full lesson checklist with gold checkmarks.
• ›Unique certificate ID for verification.
• ›Landscape A4, dark Icebox brand theme, gold accents.

Pricing

• ›Per session — $5, single lesson access.
• ›Daily pass — $15, unlimited lessons for one day.
• ›Monthly — $40, full access for 30 days.
• ›Yearly — $199, best value, full access for 12 months.

The intermediate tier of the Python track at /python-intermediate. Builds on 101 foundations with real-world tools and patterns used in professional codebases.

Curriculum — 8 Lessons

• ›Lesson 1 — File I/O and context managers: open(), CSV, the with statement.
• ›Lesson 2 — Modules and packages: imports, __init__.py, organising reusable code.
• ›Lesson 3 — Comprehensions and generators: list/dict/set comprehensions, yield, lazy evaluation.
• ›Lesson 4 — Decorators and closures: first-class functions, @property, @functools.wraps.
• ›Lesson 5 — Regular expressions: re module, named groups, substitution.
• ›Lesson 6 — Working with APIs: HTTP, the requests library, JSON, authentication.
• ›Lesson 7 — Database basics: sqlite3, CRUD, parameterised queries.
• ›Lesson 8 — Virtual environments and packaging: venv, pip, pyproject.toml.

Certificate

Complete all 8 lessons to unlock the Python 201 Certificate of Completion. Same workflow as 101 — enter email, mark lessons, generate and download or email the PDF.

IVR Access

Call the studio, press 8, then press 4 for Python Class 201.

The advanced tier at /python-advanced. Covers the skills needed to build production-grade Python applications — async, testing, packaging, and shipping.

Curriculum — 8 Lessons

• ›Lesson 1 — Async programming: asyncio, event loop, async/await, gather().
• ›Lesson 2 — Design patterns: factory, singleton, observer, strategy in Python.
• ›Lesson 3 — Metaprogramming: dunder methods, descriptors, metaclasses, type().
• ›Lesson 4 — Type hints and static analysis: typing, TypeVar, Protocol, dataclasses, mypy.
• ›Lesson 5 — Performance and profiling: cProfile, timeit, memory_profiler, slots, numpy basics.
• ›Lesson 6 — Testing and TDD: pytest fixtures, parametrize, monkeypatching, coverage.
• ›Lesson 7 — CLI tools and distribution: argparse, Click, setuptools, PyPI.
• ›Lesson 8 — Capstone: build and deploy a production application with async, types, tests, and CI/CD.

Certificate

Complete all 8 lessons to unlock the Python 301 Certificate of Completion — the highest tier Icebox Monolith Python credential.

IVR Access

Call the studio, press 8, then press 5 for Python Class 301.

Time-limited access tokens with the prefix ice_ can be issued to clients, partners, or staff for portal access without sharing a permanent staff key.

Issuing a Token — Portal UI

The fastest way: go to /admin (Control Center) and use the Token Generator panel at the top of the page. Select service, set a label and duration, click Generate — done.

Issuing a Token — API

Send a POST request to the Gatekeeper agent with your master key:

POST http://gatekeeper:8008/keys/issue
X-Master-Key: <SECURITY_TOKEN_SECRET>

{
  "label": "Studio Client A",
  "duration_days": 30
}

The response includes the ice_ token string. Copy it and give it to the client.

Using a Token

• ›Navigate to any protected page (Runner, Tenant).
• ›Paste the full ice_... token into the password / key field.
• ›Submit — the portal validates it against Gatekeeper and grants access.

Token Durations

• ›10-day trial — short studio visit or event coverage.
• ›20-day access — two-week production block.
• ›30-day access — monthly client retainer.
• ›Custom duration — set any number of days in the duration_days field.

Managing Tokens

# List all tokens
GET /keys
X-Master-Key: <secret>

# Revoke a token
DELETE /keys/<token>
X-Master-Key: <secret>

Expiry

Expired tokens return a 401 at validation time. The client sees "Invalid or expired API token." Tokens cannot be extended — issue a new one and revoke the old.

The Monolith's telephony stack uses SignalWire with webhook mode (required due to CGNAT). Inbound calls hit the Funnel URL and are routed to the IVR agent (port 8001).

Studio Numbers

• ›Main line: XXX-XXX-XXXX
• ›Both numbers configured in SignalWire pointing to the same Funnel endpoint.

IVR Main Menu

• ›Press 1 — Fan Zone: live events, streaming, merch.
• ›Press 2 — Studio access: recording studio key delivery.
• ›Press 3 — Music studio: book sessions, production services.
• ›Press 4 — Video studio: book sessions, post-production.
• ›Press 5 — Number Hub: browse and claim phone numbers.
• ›Press 6 — Tech support and remote repair connector.
• ›Press 7 — Leave a message (concerns, suggestions, other).
• ›Press 8 — Jiko Editor and Python Coding Classes.
• ›Press 9 — Staff and admin options.

Press 7 — Leave a Message Sub-Menu

Callers select a category, then hear a set of guiding questions before recording up to 3 minutes. Press # to finish.

• ›Press 1 — Concern — Prompts: nature of concern, service/staff involved, when it occurred and whether recurring, desired resolution.
• ›Press 2 — Suggestion — Prompts: what to change or add, which area it applies to, how it improves the experience, specific implementation ideas.
• ›Press 3 — Other — Prompts: topic and reason, relevant dates/services/people, what response is needed.

Press 8 — Jiko Sub-Menu

• ›Press 1 — G-Code Generator description and email link.
• ›Press 2 — HueForge mode description and email link.
• ›Press 3 — Python Coding Class 101 description and email link.
• ›Press 4 — Python Coding Class 201 (intermediate) email link.
• ›Press 5 — Python Coding Class 301 (advanced) email link.
• ›Press 0 — Return to main menu.

Voice Enrolment

Staff can enrol a voice print for wake-word and voice-command authentication. Enrolment is triggered via the Admin dashboard's Enrolment Status panel or by calling the studio and following the IVR voice-enrolment prompt.

Asterisk PBX

Internal extension 200 at 100.97.30.90 (Tailscale IP). Password: XXXXXX. Trunk configuration files are at /etc/asterisk/ on the host.

Troubleshooting

• ›Calls not routing → check IVR health at http://ivr:8001/health from Admin terminal.
• ›Voice commands not triggering → check Echo agent wake-word status on the Admin page.
• ›IVR session stuck → sessions auto-expire after 10 minutes of inactivity.

The Number Hub is a standalone virtual phone number service at /telco. You stock a pool of SignalWire toll-free numbers; customers pick one, set up their account, and get an IVR-backed voicemail box plus a 2-page mini-website — all completely independent of your other Monolith pages and services.

Admin — Managing the Number Pool

Go to /telco/admin and enter your master key.

• ›Add a number — paste the SignalWire number in E.164 format (e.g. +18005551234) and click Add. It appears as available immediately.
• ›Remove a number — only available (unassigned) numbers can be removed. Click Remove next to the number.
• ›Deactivate an account — releases the number back to the pool and disables the customer's site.
• ›Accounts tab — lists every customer with their number, total voicemail count, and unread count.

Customer Onboarding Flow

• ›Customer visits /telco and sees the available number grid.
• ›They click a number → taken to /telco/onboard with that number pre-selected.
• ›They fill in: business name, a URL handle (e.g. mikes-plumbing), email, password, page headline, tagline, about text, and accent color.
• ›On submit their account is created, the number is marked assigned, and they land on their public page.

Page 1 — Public Business Card

URL: /telco/[handle] — no login required. This is the page the customer shares with their own clients.

• ›Shows their business name, tagline, and about text.
• ›Large clickable phone number with a Call Now button.
• ›Accent color customised per account (set during onboarding, changeable later).
• ›Links to their messages inbox via the My Messages button.

Page 2 — Voicemail Inbox

URL: /telco/[handle]/messages — password protected.

• ›Customer enters their account password to access the inbox.
• ›New (unlistened) messages are highlighted with a colored left border and a NEW badge.
• ›Each entry shows: caller number, duration, timestamp, and transcript (when available).
• ›Controls per message: ▶ play (opens recording URL), ✓ mark read, ✕ delete.
• ›Refresh button pulls the latest messages from the server.

Inbound Call Flow

• ›Caller dials the customer's 800 number.
• ›SignalWire fires a webhook to /api/telco/webhook/call.
• ›The Telco agent looks up which account owns that number.
• ›Plays the customer's custom greeting (or a default if none is set).
• ›Records up to 2 minutes of voicemail and stores it against the account.
• ›Recording metadata is saved immediately; the customer sees it in their inbox on next refresh.

SignalWire Configuration

In your SignalWire dashboard, set the inbound webhook for each pooled number to:

POST https://orangepi5-plus.tail8c906d.ts.net/api/telco/webhook/call

Use the same URL for all numbers in the pool — the Telco agent identifies the correct account from the To field in the webhook payload.

Custom Voicemail Greeting

Each account's greeting defaults to "You have reached [Name]. Please leave a message after the tone." Customers can update it via the API:

PUT /api/telco/accounts/[handle]
X-Access-Key: <their-password>

{ "voicemail_greeting": "Thanks for calling Acme. Leave your name and number." }

Telco Agent

The backend service runs internally at telco:8018. It is not exposed directly through nginx — all calls route through the portal's /api/telco/* proxy. The voicemail database is stored at /mnt/master_vault/telco.db and is included in all master image snapshots.

Troubleshooting

• ›Numbers not showing → check Telco agent health via Admin terminal: curl http://telco:8018/health
• ›Webhook not firing → confirm the SignalWire number's webhook URL is set to the Funnel address above.
• ›Account handle taken → handles are globally unique; customer must choose a different one.
• ›Voicemails not appearing → verify recording webhook URL is reachable; check SignalWire recording callback logs.

AI-powered music production agent at /beats/. Converts a text or voice description into a fully mastered audio track using your studio's sound libraries — SF2 soundfonts, LMMS samples, and ZynAddSubFX banks.

Current Status

Music generation is currently disabled by default (MUSIC_GEN_ENABLED=false in the environment). The MusicGen model requires 4–6 GB of RAM on load; disabling it keeps that memory available for other services. To re-enable: set MUSIC_GEN_ENABLED=true in /home/ice/.env and redeploy the stack.

Generating an Instrumental

POST to /beats/generate with a JSON body:

POST /beats/generate
{ "prompt": "dark trap beat, 140 BPM, C minor, heavy 808 bass, hi-hat rolls, melancholy piano melody" }

Returns a job_id. Poll /beats/jobs/{job_id} for status.

Voice Description

Upload an audio file describing the track to /beats/generate/voice. Echo's STT transcribes it, then the track is generated automatically.

Full Song with Vocals

Submit a text prompt and a vocal audio file together for a complete production:

POST /beats/generate/with-vocals  (multipart/form-data)
  prompt=  "soulful R&B, 75 BPM, D minor, warm Rhodes chords, smooth bass"
  vocals=  <audio file>

Vocals are processed (noise gate, compression, reverb), mixed at proper levels against the instrumental, and the result is mastered to broadcast standard (-14 LUFS).

Add Vocals to an Existing Job

POST /beats/mix-vocals/{job_id}  (multipart/form-data)
  vocals=  <audio file>

Download the Track

GET /beats/download/{job_id}   → 320 kbps MP3

Sound Libraries Used

• ›FluidR3_GM / TimGM6mb — Full GM soundfonts for all melodic instruments.
• ›LMMS samples — Drums, beats, basses, instruments, waveforms.
• ›ZynAddSubFX banks — Synthesizer patches: pads, leads, brass, choir, and more.

Job Statuses

• ›queued — Waiting to start.
• ›parsing — Claude is generating the arrangement.
• ›building_midi — Constructing MIDI tracks.
• ›rendering — FluidSynth rendering MIDI to audio.
• ›mixing_drums — Layering drum samples via FFmpeg.
• ›mixing_vocals — Processing and mixing vocals.
• ›mastering — Applying mastering chain (-14 LUFS).
• ›done — Track ready to download.