Body Camera Streaming Protocols: RTMP, RTSP, CMSV, and 10 Open-Source Platform Options

Act as the audiovisual integration engineer and full-stack developer for a
private body camera live streaming prototype. Use the route I specify next.
Build a system whose behavior can be verified, with evidence for every claim.

Device and environment inputs:
MODEL=<exact model>
HARDWARE_REV=<revision or UNCONFIRMED>
FIRMWARE=<exact firmware>
REGION_AND_CARRIER=<region/carrier; do not request SIM secrets>
SOURCE_MODE=<RTMP_PUSH / RTSP_PULL / SRT / GB28181 / CMSV / UNCONFIRMED>
VIDEO_CODEC=<H264 / H265 / UNCONFIRMED>
AUDIO_CODEC=<AAC / G711 / Opus / no audio / UNCONFIRMED>
TARGET_RESOLUTION_FPS=<streaming parameters, not local recording specs>
DEVICE_AUTH_METHOD=<documented method or UNCONFIRMED>
CUSTOM_URL_RULE=<complete URL / host plus stream name / appended device ID /
  UNCONFIRMED>
TLS_SUPPORT=<device support for the relevant encrypted protocol or UNCONFIRMED>
DEVICE_NETWORK=<LAN / public mobile address / CGNAT / private APN / UNCONFIRMED>
SERVER_OS=<existing OS; otherwise propose a supported, maintained Linux release>
SERVER_ARCH=<amd64 / arm64 / UNCONFIRMED>
PUBLIC_HOST=<my domain; use stream.example.com only as an illustrative placeholder>
RECORDING=<off unless explicitly needed>
RETENTION=<my requirement; do not invent a statutory retention period>
PILOT=<one device and one viewer first; scale only to an agreed plan>

Working rules:
1. Read the project's official repository, target stable-release documentation,
   LICENSE, and security guidance. Produce sources.md and versions.lock with
   version/commit, image source and digest where available, documentation URLs,
   review date, licenses, and dependencies. Do not use latest or mix development
   configuration with a stable release. Mark newer/commercial-only features as
   limitations; do not pretend to implement them through unsupported settings.
2. Describe camera -> ingest -> optional transcoding -> viewer, including
   connection direction and ports. Separate media from GPS/SOS/talkback/control.
   Do not invent a device protocol. Do not assume cloud access to an RTSP camera
   behind CGNAT, or that the camera can install a VPN client.
3. Work in an isolated project directory. Do not overwrite another project,
   change production services, or purchase cloud resources. Use the release's
   supported deployment method: compose.yaml where supported, otherwise
   reproducible native installation steps. Avoid unverified container images.
4. Prove one media path before building the dashboard. If a physical camera is
   unavailable, use explicitly labeled simulated media for server validation
   and mark physical-device interoperability NOT_TESTED.
5. Inspect codecs, resolution, frame rate, audio, keyframes, and timestamps.
   Copy compatible video; transcode audio/video only where necessary and explain
   CPU/GPU costs. Protocol conversion is not transcoding. Do not assume H265 or
   AAC works in the intended WebRTC client.
6. Reuse an existing backend stack where appropriate. Otherwise choose a small,
   maintained backend and minimal page; avoid premature microservices/Kubernetes.
   Track device ID, media path, permissions, last media activity, and useful
   operational events. Distinguish heartbeat from active media. Without a real
   status interface, report UNKNOWN rather than simulated device health.

Access protection:
- Separate administrator, viewer, and device-publishing credentials. Each device
  may publish only its assigned stream; viewers may read only assigned devices.
- Use mechanisms actually supported by the chosen release. Adapt them through
  the backend when needed; do not assume a camera can enter an arbitrary JWT.
- Never send device stream keys, vendor SDK secrets, or management API keys to
  the browser. Keep real credentials out of chat, bundles, logs, examples, and Git.
- Protect signaling, HLS playlists/segments, snapshots, recordings, and downloads,
  not just the home page. Restrict direct-origin bypass and unused anonymous access.
- Give viewing sessions an expiration and revocation policy. Test what revocation
  does to existing connections as well as new requests.
- Store secrets in local untracked secret/config files; .env.example uses placeholders.
- Do not label plaintext media encrypted. With plaintext-only camera RTMP/RTSP,
  use an isolated test network or a protection path supported by the device/gateway.
  HTTPS or TLS at the server cannot encrypt the earlier camera-to-proxy hop.
- Explain HTTPS signaling, actual media ports, NAT public-address advertisement,
  and STUN/TURN. An HTTP reverse proxy is not a proxy for all UDP media.

Deliver in three stages:
A. docs/architecture.md, version/capability table, port table, unknowns, minimal plan.
B. Configuration, backend/page code, .env.example, start/stop/update/rollback steps,
   health checks, logs, and disk limits. Start only in the authorized test environment.
C. tests/evidence.md containing commands, time, environment, results, and redacted
   logs. Label every check PASS / FAIL / NOT_TESTED. Static validation is not a
   substitute for camera or browser testing.

Minimum acceptance: valid publishing; rejection of invalid publishing credentials;
unauthorized and cross-device viewing denied; direct media/HLS segment access;
expiration/revocation; network recovery; camera and server restart; target desktop
and phone audio/video; sustained resource use; recording search/expiry if enabled.
Ask me to set performance thresholds or explicitly label yours as proposals.
Do not promise unmeasured latency, concurrency, runtime, or compatibility.
Proceed with independent work. Consolidate questions only for missing facts that
actually determine the integration route.

Under P00, use MediaMTX for a one-camera private viewing prototype.

1. Enable only the required input. RTMP_PUSH means the device connects outward;
   RTSP_PULL means the server pulls an authorized, reachable source. Do not expose
   every protocol by default.
2. Use the target release's configuration example. Map a device ID to a unique
   media path. Restrict the management API to the backend or controlled network;
   do not give browser clients its credentials.
3. Provide one WebRTC viewing page first. If codecs are incompatible, report
   inspected input metadata and add necessary FFmpeg/GStreamer processing, or
   explicitly choose a compatible HLS path. Authorize both paths if both exist.
4. Choose supported internal/HTTP/JWT authentication that the camera can use.
   Authorize publish, read, and playback separately. Remove unrestricted sample
   permissions. If the camera accepts only a short stream name, propose a controlled
   adapter instead of forcing a long token into an unsupported field.
5. Distinguish connecting, active media, offline/no media, authentication failure,
   and codec incompatibility. Enable recording only if requested, with supported
   formats, playback methods, and independent access control.
6. Deliver pinned binaries/images, minimal configuration, port table, backend auth,
   and evidence. Test reconnecting to the same path, invalid publishing credentials,
   cross-path access, playback expiration, and actual audio handling in the browser.

Under P00, use SRS for RTMP camera -> SRS -> browser.

1. Verify and pin a current stable release. Do not infer old-release capabilities
   from a newer README. For RTSP-only devices, inspect the chosen release; if a
   bridge is needed, include FFmpeg/GStreamer as a separate monitored component.
   Do not send an RTSP URL to an RTMP port.
2. Enable the required RTMP and WebRTC/HLS paths using official configuration.
   Set the public candidate, container mappings, and signaling address correctly.
   Document web ports separately from media ports.
3. Validate publishers through supported callbacks or access mechanisms. Have the
   application backend authorize viewers and identify how WebRTC and HLS access
   is actually enforced. A login page alone is insufficient.
4. Verify the input audio path to the chosen WebRTC output using capabilities
   present in this build. Do not assume any H265/AAC input will work automatically.
5. Provide a device list, single-stream viewer, offline state, and minimal event
   records. If recording is needed, do not merge reconnect sessions into a claim
   of uninterrupted footage.
6. Test republishing, duplicate stream names, service restarts, invalid keys,
   expired viewing sessions, and the failure where HTTP works but media ports do not.
Deliver reproducible configuration, authorization service, and troubleshooting notes.
A sample player is not a complete device platform.

Under P00, use an open-source ZLMediaKit build for a one-camera integration pilot.

1. Pin the version/commit and build options. Save LICENSE and its additional terms.
   Preserve required ZLMediaKit identification; do not create a branding-removal patch.
2. Make a capability table for RTSP/RTMP input, WebRTC/HLS output, recording, APIs,
   and webhooks. Separate professional closed-source capabilities from this build.
   Use explicit external transcoding or mark it unsupported. Do not treat Pro
   JT1078 or other commercial functions as working open-source configuration.
3. Start with one source type. Use actual versioned APIs/webhooks to associate
   streams, devices, and permissions. Keep API secrets on the backend. Validate
   callback origins so arbitrary requests cannot fabricate device health.
4. Enforce publishing and playback access at the media boundary. Reject unauthorized
   publishing, cross-device viewing, and direct-origin bypass. Distinguish control
   service health from active media; missing frames must not look healthy.
5. If GB28181 is needed, identify whether WVP must supply SIP signaling. An RTP
   receiving port is not a complete SIP/device-management service.
6. Test connect/disconnect callbacks, idempotent duplicate events, interruptions,
   audio/video across outputs, unauthorized media access, and file downloads.
Deliver the actual build capability list and unresolved requirements.

Under P00, use OvenMediaEngine and a compatible OvenPlayer version.

1. Pin open-source engine/player versions and record AGPL-3.0-only and dependencies.
   Do not assume enterprise features are included.
2. Choose RTMP push or reachable RTSP pull from the real device information. Use
   valid configuration for this release. Begin with one rendition; add a second
   only when target clients and bandwidth justify it.
3. Compare input codecs with WebRTC/LL-HLS requirements. Specify copied and
   transcoded tracks. Do not invent available GPUs, drivers, or acceleration.
4. Use supported access controls with backend authorization for publishing/viewing.
   Protect fallback playback, segments, snapshots, and recording files too.
5. Show device, playback mode, and connection failures in the page. Record measured
   performance operationally; do not display advertised latency as our result.
6. Compare CPU/memory/bandwidth for one and two renditions. Test phone playback,
   sound, reconnects, expired access, and unauthorized LL-HLS segments. Record
   transcoding conditions and observed bottlenecks.

Under P00, use only Ant Media Server Community Edition.

1. Verify the selected Community release and cite support for each needed feature.
   Do not use an Enterprise trial image or confuse WebRTC ingest with playback.
2. Start with RTMP input and HLS output. For RTSP-only cameras, verify source-pulling
   support in this Community version before configuring it. Do not silently add
   Enterprise adaptive bitrate, clustering, or advanced stream-security features.
3. Use the management panel for media administration, with separate device access
   rules for viewers. If native Community protection is insufficient, use a controlled
   network or a verified protection layer that prevents origin bypass. State any
   protection requirement that cannot actually be met.
4. Build only missing device mapping, authorized viewing, and status functions;
   do not recreate the entire administration panel.
5. Test unauthorized HLS playlists/segments, recording downloads, management APIs,
   and reconnects. If WebRTC playback is required but unavailable in Community,
   stop that extension and list alternative open-source or licensed routes.
Clearly report the installed edition, version, license, and actual test scope.

Under P00, build a small prototype using NGINX and nginx-rtmp-module.

1. Pin a maintained NGINX version and module commit. Check build compatibility and
   provide reproducible build steps instead of an unknown, outdated container image.
2. Implement RTMP ingest, HLS delivery, and essential status only. Do not claim native
   WebRTC. If RTSP is needed, explicitly add an authorized pull bridge and monitor it.
3. Verify publishing credentials with supported callbacks. Authorize HLS HTTP routes
   separately, including m3u8 playlists and every media segment. RTMP playback auth
   does not establish HLS access control.
4. Set capacity and cleanup policies for temporary HLS data, recordings, and logs.
   Use necessary filesystem permissions, not globally writable/readable directories.
5. Configure protected transport where the selected build supports it. HTTPS for
   the website does not encrypt an otherwise plaintext RTMP source connection.
6. Test invalid keys, duplicate publishers, exposed segments, origin bypass, disk
   pressure, service restarts, and network recovery.
Deliver minimal NGINX configuration, auth service, page, build versions, and
maintenance limitations.

Under P00, use the Janus Streaming plugin for a controlled viewing application.

1. Pin Janus, plugin configuration, and the official JavaScript integration method.
   Record GPL-3.0 and dependency terms.
2. Inspect input requirements. For RTSP, confirm plugin build support, including
   libcurl, transport, authentication, and codecs. Where unsuitable, explicitly use
   FFmpeg/GStreamer to supply compatible RTP. An RTMP source needs an actual
   receiving/bridging component, not a direct connection to an RTP port.
3. Give each device a controlled mountpoint. The backend decides which mountpoints
   each user may access. Never deliver administrative/create/delete secrets to
   viewers. Guessing an ID must not bypass authorization.
4. Build a minimal page for backend authorization, session creation, subscribing,
   error display, and cleanup. Document ICE, STUN/TURN, and media ports; proxying
   WebSocket alone does not establish media connectivity.
5. Do not assume Janus automatically transcodes. Record input/output codecs and
   explicitly place necessary conversions in the architecture.
6. Test multiple subscribers, unauthorized mountpoints, disconnected-session cleanup,
   source interruption/recovery, and mobile networks. Without a real device audio
   return interface, do not present a working camera-talkback button.

Under P00, use self-hosted LiveKit Server and a separate Ingress service.

1. Do not depend on a LiveKit Cloud account. Pin server, ingress, SDK, and dependency
   versions. Document self-hosted deployment relationships and component licenses.
2. Use the selected release's real CreateIngress API from the backend to map the
   RTMP camera to a designated room and identity. Keep publishing URLs/keys for
   device configuration only. With RTSP-only input, propose a tested bridge rather
   than inventing a native RTSP Ingress interface.
3. Issue short-lived, least-privilege room tokens on the backend. Viewers cannot
   publish by default. Enforce actual room/track subscription permissions; hiding
   another device in the UI is not device isolation.
4. Display authorized video and media state. Add expert browser audio/video only
   when requested. Browser conversation and camera talkback require separate
   acceptance; without a documented device interface, do not provide the latter.
5. Deploy Egress only if recording is required. Distinguish track and room recording,
   authorization, storage, and cleanup. Ingress/Egress are not automatically
   configured merely because the main server container is running.
6. Test invalid stream keys, room/track access violations, permission revocation,
   stable device identity after reconnects, token expiry on existing connections,
   and external/mobile connectivity.
Report measured resources. A room demonstration is not a fleet-capacity test.

Under P00, connect one device confirmed to support the target GB28181 version
using WVP and ZLMediaKit.

1. Obtain the actual standard version, device/channel IDs, SIP domain, authentication,
   signaling transport, RTP transport, and codecs. Mark missing facts UNCONFIRMED.
2. Pin compatible WVP/ZLM versions. Follow their current dependency requirements;
   do not mechanically copy old database/Redis tutorials. Record component licenses
   and ZLM's additional identification requirements.
3. Map SIP registration/heartbeat/directory/INVITE separately from RTP media,
   including ports, public advertised addresses, and container mappings. Do not
   confuse the camera's address with the media server's advertised address.
4. Replace default credentials and protect WVP administration, ZLM APIs, and hooks.
   Limit public exposure. Test camera credentials separately from viewer access.
5. Record registration, heartbeat, directory discovery, stream request, media receipt,
   playback, and session termination in sequence. Keep redacted request/response
   or log evidence for each. Registration alone is not completed integration.
6. Do not enable upstream platform cascading in the first prototype. If needed,
   scope a separately authorized test. For 808/1078, recheck actual open-source
   capabilities of WVP and the media component plus the device protocol. CMSV
   labeling alone is not a reason to configure a device as JT1078.

Under P00, use Owncast for a single body camera demonstration channel.

1. Define this as one input, not a completed fleet platform built from several
   pages. Pin the version and configure RTMP input/HLS output according to its
   documentation, including required FFmpeg and other dependencies.
2. Retain the existing page, customize necessary title/offline messaging, and
   disable unwanted chat or public discovery features where supported.
3. For internal video, verify this release's auth plugin/protection layer. Do not
   select a website-only mode and claim the media is protected. Test the player,
   HLS playlists, segments, and status endpoints. New documentation does not
   establish that an older installed release supports the same feature.
4. Prefer controlled local delivery for the first prototype. If adding object
   storage/CDN, design separate segment authorization; entrance login does not
   protect public object URLs.
5. Keep stream keys separate from administrator access. Do not expose keys through
   public configuration endpoints.
6. Test logged-out page access, embedding, native playback, and direct media URLs.
   Document compatibility limits introduced by authentication. Test source stopping,
   reconnecting, and old-segment cleanup.
If requirements expand to grouped device dispatch, GPS/SOS, or complex permissions,
recommend reevaluating the architecture. A visual reskin does not implement them.

I want to integrate a body camera labeled CMSV in its configuration tool with
my application. Investigate first; do not invent a compatible protocol server
from the name or screenshot.

Create an evidence table:
- Exact camera, hardware, firmware, configuration-tool version, platform provider,
  and platform version.
- Device protocol documentation/SDK; license scope and test-account setup process.
- Login, session expiration/refresh, device/channel identifiers, meaning of online.
- Live media acquisition, delivery protocol, codecs, URL lifetime, stream stop method.
- Separate documented/licensed support for status, GPS, SOS, talkback, recording
  queries, and downloads.
- SDK operating systems, CPU architectures, dependencies, redistribution terms,
  and version constraints.
Mark unavailable facts UNCONFIRMED. Do not infer them from familiar ports or a
different vendor's documentation.

When documentation is sufficient and licensing permits, design a backend adapter:
1. Keep platform credentials and SDK secrets on the backend. Use our own short-lived
   sessions in the frontend.
2. If the platform supplies an authorized standard media URL, verify its lifecycle
   and concurrency rules before choosing controlled direct playback or a relay
   through MediaMTX/ZLM or another service.
3. If a proprietary SDK is mandatory, identify the separate deployment and licensing
   boundary. Do not call the entire solution a purely open-source CMSV replacement.
4. Separate device and media state. Gate GPS/SOS/talkback by verified capability.
   Unsupported functions are unavailable, not simulated coordinates or success.
5. Test revoked stream access, expired platform sessions, offline devices, and SDK
   reconnection using the actual integration.

Deliver capability-matrix.md, interface-source index, adapter interface design,
the smallest executable documented path, and blocking unknowns. Without documents,
clearly labeled stubs can support UI work, but do not claim device integration.
Do not bypass authentication or licensing.

Review the streaming prototype. Inventory the real environment and running service
versions, then verify device -> network -> ingest -> codecs -> playback -> access
-> recording/control. Container health or an HTTP 200 home page is not completion.

For each check, report PASS / FAIL / NOT_TESTED with reproducible evidence:
1. Physical device model/firmware, input codecs, resolution, frame rate, audio,
   and timestamps. Separate simulated input from real-camera input.
2. Publishing access: invalid, expired, and revoked credentials; camera A must
   not take camera B's stream.
3. Viewing access: logged-out users, user A accessing B, direct players/media URLs,
   HLS segments, snapshots, recording downloads, administration APIs, and direct
   origin access bypassing the reverse proxy.
4. Expiration/revocation: test new requests and existing connections separately,
   recording when enforcement actually takes effect.
5. Network recovery, device/server restart, duplicate publishing, duplicate events.
   A frozen last frame must not appear to be a continuing live stream. Save states
   and logs that make the difference observable.
6. Target desktop/phone audio, video, autoplay, and full screen. Where available,
   also inspect 1440/720/390/320px page layouts. Without a browser test, use NOT_TESTED.
7. End-to-end delay: method, time reference, sample count, range, and uncertainty.
   Do not substitute the project's advertised latency for measurement.
8. Planned concurrency: CPU, memory, ingress/egress, transcoding, disk, and TURN
   traffic. Record hardware, bitrates, viewing combinations, and duration. Do not
   extrapolate a result to untested capacity.
9. If recording is enabled: authorization, time search, gaps, low-disk behavior,
   expiration. Local camera recording, server live recording, and outage backfill
   are separate capabilities requiring separate verification.
10. Test GPS/SOS/talkback only where actual interfaces exist. A clicked button is
    not evidence that a device completed the operation.

Deliver README, version/dependency inventory, architecture/port table, actual test
evidence, limitations, start/stop, backup/restore, upgrade/rollback, and credential
rotation procedures. Distinguish demonstrable prototype, completed device
integration, readiness for a pilot, and satisfied production requirements.
Keep untested items visible. Do not fabricate logs, expand production access,
or change device permissions outside the authorized scope.