A private-network reference implementation that lets an Android phone act as a remote microphone and speaker for a Mac. Mumble carries encrypted full-duplex audio over Tailscale or WireGuard; CoreAudio virtual devices keep inbound mic, outbound playback, and echo-cancelled mic on separate buses.
An optional macOS lifecycle watcher can turn a fresh, authenticated remote
speech edge into the user-configured Codex Voice shortcut. It confirms success
from Codex's realtime_session_started lifecycle event rather than treating a
keyboard event, cooldown, or visible window as proof.
No public ingress, remote shell, credential storage, audio recording, compiled APK, binary, or machine-specific service file is included.
flowchart LR
A["Android Mumla Bridge"] <-->|"Mumble over private overlay"| S["Mumble server"]
S <--> M["Mac Mumble client: MacBridge"]
M -->|"phone mic"| B2["Raw mic bus"]
APP["Mac app audio"] --> B16["Playback reference bus"]
B16 --> M
B2 --> AEC["Mini SpeexDSP AEC"]
B16 --> AEC
AEC --> B64["Clean mic bus"]
B64 --> TARGET["Target voice app"]
The numbered BlackHole devices in the example are roles, not a protocol requirement. Device names are configurable. Other CoreAudio loopback drivers can be used if they provide three independent buses.
- Rebuildable macOS CoreAudio/SpeexDSP AEC and bounded test-tone utility.
- A runtime-generated per-user service installer; no local plist is tracked.
- Sanitized Mumble server and audio-routing examples.
- Reproducible GPLv3 patches for pinned Mumla and Humla revisions.
- Setup, layered verification, rollback, security, and troubleshooting guides.
- A fail-closed Codex Voice trigger with deterministic lifecycle tests.
- CI checks for patch applicability, source builds, accidental secrets, and forbidden artifacts.
- Read the security model.
- Follow the setup guide.
- Apply and build the Android patches.
- Complete every gate in the verification guide.
- Optionally install the Codex Voice trigger.
- Keep the rollback guide available before changing audio routing.
- A running AEC process or non-zero virtual-device meter does not prove that the target app captured usable speech. Target-app transcription or recording is a separate mandatory verification gate.
- Speex echo return loss enhancement is diagnostic evidence, not by itself a pass. Audible sidetone, repeated speech, or feedback is a failure.
- Remote-desktop audio and local monitoring must be off. In the reference setup, a parallel remote-desktop audio path was sufficient to recreate feedback.
- The Android patch intentionally accepts downlink voice only from the generic
Mumble username
MacBridge. Change that constant consistently if you use a different role name. This filter prevents accidental playback; it is not an authentication mechanism. - Legacy browser WebRTC and unauthenticated raw-UDP experiments are intentionally outside this release. They are not required by the final Mumble architecture.
- Codex Voice activation uses macOS UI automation because no supported public API exists for toggling that UI. Review the helper before granting Accessibility or Automation permission.
Original project content is MIT licensed. Android patches are GPLv3; see
NOTICE.md and LICENSES/GPL-3.0.txt.