Pt97 compliance, Add strict gatekeeper mode for Meshtastic/MeshCore ingress

README.md

@@ -1,8 +1,13 @@
 # Raven Mesh Messaging Platform
 
 Raven is a decentralized mesh messaging platform for AREDN© with the ability to bridge messages from AREDN to other message platform.
-Currently it interoperates with Meshtastic, MeshCore and Winlink.
+Currently it interoperates with Meshtastic, MeshCore, Winlink, and APRS.
 
 Documentation can be found here https://github.com/kn6plv/Raven/wiki
 
 <img width="1024" height="573" alt="Screenshot 2026-02-25 at 8 56 21 AM" src="https://github.com/user-attachments/assets/d0f51937-e1b8-46ad-99de-da5055f8567e" />
+
+## New Fetures guides (prsented by KJ6DZB with help of AI)
+
+- [APRS bridge](APRS.md) - APRS-IS, Xastir/YAAC-style TCP text streams, Dire Wolf KISS TCP, direct messages, groups, and group repeat mode.
+- [Strict Gatekeeper mode](STRICT_GATEKEEPER.md) - optional fail-closed filtering and gateway identification for Meshtastic/MeshCore ingress.

STRICT_GATEKEEPER.md

@@ -0,0 +1,31 @@
+# Strict Gatekeeper mode
+
+Strict Gatekeeper mode is an optional fail-closed bridge policy for sites that want tighter control over Meshtastic or MeshCore text traffic before it is forwarded to AREDN.
+
+Example configuration:
+
+```json
+{
+  "strict_gatekeeper": {
+    "enabled": true,
+    "gateway_callsign": "W6XYZ",
+    "allowed_callsigns": ["KN6PLV", "KJ6DZB"]
+  }
+}
+```
+
+When enabled, Raven applies these controls before Meshtastic or MeshCore ingress is admitted to the routing queue:
+
+- encrypted Meshtastic protobuf packets are dropped instead of decrypted for bridge forwarding;
+- non-text bridged packets are dropped;
+- the sender name must contain a US-style amateur callsign token such as `KN6PLV`, `W6XYZ`, or `KJ6DZB`;
+- if `allowed_callsigns` is non-empty, the extracted sender callsign must also appear in that whitelist;
+- forwarded text is re-written to originate from the gateway node, and the body is prefixed as `[SENDER via GATEWAY] message`.
+
+## Operational caveats
+
+Strict Gatekeeper mode is a transport safety control, not an identity proof system. Meshtastic and MeshCore display names are user-controlled, so a node can be renamed to look like a valid callsign. For real deployments, use `allowed_callsigns`; a future hardening step should bind allowed operators to a stable Meshtastic node ID or MeshCore public key.
+
+The built-in callsign validator intentionally matches only a simple US amateur callsign form: one or two letters, one numeral, and one to three letters. It will reject international callsigns, special-event formats, and suffix forms that do not contain an extractable US callsign token.
+
+Dropped packet logging uses the existing `DEBUG0` and `DEBUG1` debug channels. On headless OpenWrt deployments, confirm that log output is captured by the service manager or `logd` before relying on logs for troubleshooting.