RB.3 Aphrodite streaming-substrate extraction audit

Audit date: 2026-07-18

Ledger item: RB.3 service audit Status: Complete — 17 deployable services and 36 directly adjacent libraries were read sequentially; extraction work remains separate and open.

Decision standard#

This audit separates reusable live-media mechanics from Aphrodite's adult-ring policy and product surfaces before any code moves. A service is not reusable merely because its names are generic. For each deployable app, the audit checks its composition root, routes or UI boundary, state and repository interfaces, cross-package dependencies, tests, and production defaults. Each verdict is one of:

• extract organ — move the reusable behavior behind a tenant-parameterized shared streaming contract, preserving Aphrodite through equivalence tests;
• thin tenant adapter — keep Aphrodite policy/presentation in the app and replace generic mechanics with shared-organ calls;
• retain tenant control plane — the app is not a streaming organ; connect it only through narrow substrate hooks; or
• client of substrate — the surface consumes shared viewer/broadcaster contracts and owns no server-side media organ.

Production-readiness gaps are recorded because extraction must not turn an in-memory default, simulated transform, or permissive auth boundary into a shared promise. The target remains one shared stack consumed by Aphrodite, Veritas, V3 Stage, and the V10 video lane; it does not create a second stack under apps/v10 or libs/v10.

Deployable inventory#

1. apps/aphrodite/admin#

Role and boundary. A deployable Hono admin API on port 3004 exposes public health/selected-settings reads and bearer-protected user, moderation, and settings routes. Its domain types cover account sanctions, content flags and review actions, audit records, platform settings, and operational metrics. The service emits local process events after mutations; it does not ingest, transcode, deliver, or play media.

State and integration reality. The service defines useful repository ports for users, audit logs, moderation items, and settings, but its composition root installs in-memory repositories by default. The current auth middleware checks only for a Bearer prefix and then stamps a fixed mock administrator; its own comment defers real JWT/JWKS verification. The only service-specific automated test file covers moderation escalation and terminal-state behavior. These facts make the current app unsuitable as a shared authorization or durable moderation authority.

Generic vs tenant-specific. Queue pagination, moderation lifecycle, audit recording, and settings interfaces are broadly useful control-plane concepts. The concrete violation taxonomy, public settings, admin roles, moderation policy, and user-action semantics belong to Aphrodite and its adult-ring governance. None is required in the synchronous media path.

Reuse verdict: retain tenant control plane. Do not move this app into the streaming substrate. Shared live chat and ingest should expose narrow, tenant-parameterized moderation/event hooks that this service can consume. Aphrodite remains responsible for authenticating operators, choosing policy, persisting cases, and applying sanctions. Before it can protect a production tenant, its composition root needs verified operator identity and durable repositories; RB.3 must not disguise those separate gaps as extraction.

2. apps/aphrodite/admin-bi-dashboard#

Role and boundary. A deployable Hono reporting API exposes platform, revenue, user, content, and compliance endpoints plus health and a static API description. It is an operator read surface; it owns no ingest, media delivery, viewer session, or chat lifecycle.

State and integration reality. The app has logger/cache injection seams, but its default cache is process-local and the server never composes the listed analytics, database, prediction, or Redis dependencies into route data. Instead, the route modules derive purported users, streams, revenue, bitrate, moderation, age-verification, 2257, and GDPR results from hard-coded category tables and per-request deterministic hash functions; export records are likewise generated in the response path. No authentication or permission middleware populates the declared adminId/permissions context. Production CORS narrows origins, but the factory default is wildcard while credentials are enabled. The Nx test target explicitly permits zero tests, and the app contains no test files.

Generic vs tenant-specific. Period parsing, pagination schemas, cache interfaces, and report response shapes could inform a generic operations API. The named categories, adult compliance reports, revenue assumptions, synthetic thresholds, and presentation taxonomy are Aphrodite policy. More importantly, none of the returned values is an authoritative measurement today.

Reuse verdict: retain tenant control plane. Do not extract its generated reports or call them substrate telemetry. Shared streaming organs should emit a small, versioned tenant-tagged operational event/metric vocabulary and expose real read-model ports. Aphrodite may keep this API as its dashboard composition surface after replacing formulas with authenticated queries. Until then, it is neither an equivalence oracle nor a production source for viewer, quality, revenue, or compliance claims.

3. apps/aphrodite/analytics#

Role and boundary. This Hono application accepts single and batch analytics events, queries the event ledger, returns stream/creator/viewer metrics, and computes creator-dashboard rollups. Its pipeline normalizes and validates events, performs process-local ID deduplication and buffering, and writes through an IAnalyticsClient. The production factory defaults to the real Postgres-backed SqlAnalyticsClient from @aphrodite/analytics-warehouse; tests inject the supplied in-memory implementation.

State and integration reality. The SQL client persists and aggregates the analytics_events table, while the dashboard derives several finer measures from paged raw events. Eleven focused tests exercise configured-store ingest and dashboard calculations. However, the app has no authentication or authorization middleware: public callers can ingest arbitrary identity-bearing events, query viewer and creator history, read earnings, or invoke the nominal admin flush. Neither the event contract nor the SQL table access includes a tenant key, so IDs are globally trusted and isolation cannot be enforced. The package's start script executes dist/index.js, but source index.ts only exports the factory and contains no Node listener, signal handling, or initialization call. The deduplication cleanup interval is not retained or cleared on shutdown, and some SQL rollups deliberately return zero for unimplemented fields such as unique viewers, durations, and engagement. These are extraction blockers, not properties to preserve as shared production behavior.

Generic vs tenant-specific. Buffered ingestion, batch failure reporting, an append-only event-store port, bounded metric queries, and operational stream measurements are reusable mechanics. The concrete taxonomy combines generic stream/viewer events with Aphrodite monetization, private-show, device, social, and VR product events; the creator earnings and audience dashboard is likewise an Aphrodite read model. User, creator, and stream IDs without a tenant context are not a safe cross-product contract.

Reuse verdict: extract organ. Define a small versioned, tenant-required live-media telemetry envelope and durable sink/read ports in the shared substrate. Extract the validated batching/lifecycle mechanics only after adding bounded buffering, managed timers, authenticated producer/reader context, and cross-tenant denial tests. Keep the adult monetization/social taxonomy and creator-dashboard projections behind a thin Aphrodite adapter that maps to its own warehouse. The existing app and schema remain migration inputs and equivalence fixtures; they are not the final multi-tenant telemetry service.

4. apps/aphrodite/analytics-dashboard#

Role and boundary. This is a server-side Hono reporting and prediction API, not a browser dashboard. It serves revenue, viewer, engagement, trend, creator/viewer/admin/realtime dashboard, alert, segment, funnel, export, and prediction routes, and attaches a WebSocket server on port 3400. Its principal read path pages @aphrodite/analytics-warehouse events and calculates bounded rollups; Sophia models consume those real histories for selected prediction routes.

State and integration reality. The default analytics dependency is the real SQL client, with an injectable client for tests. Quick exports and the primary HTTP reports now derive values from actual events or return explicit 501 errors when a source/model is absent. The 112 route/model tests are meaningful evidence against the earlier hash-derived HTTP reports. That does not make the entire surface authoritative: alert configurations, segments, and funnels include hard-coded lists and create/update/delete handlers that only echo a response; several acknowledgement/detail paths synthesize records. Layout, export-job, and scheduled-report persistence is absent. Every WebSocket channel is generated from deterministic hash formulas rather than the warehouse, despite being advertised as real-time analytics. The default cache is process-local, and the global SQL client is neither closed nor reset during context shutdown.

Security and tenancy. No HTTP middleware authenticates a viewer, creator, or administrator or binds request-scope IDs. All reporting, mutation, prediction, WebSocket stats, and WebSocket subscription paths are public. A caller-selected clientId identifies a socket but proves no identity, and channel filters do not enforce tenancy. Like the underlying warehouse contract, all queries lack a tenant dimension. The production CORS fallback can resolve to * with credentials when CORS_ORIGINS is unset; CORS would not substitute for access control in any case.

Generic vs tenant-specific. Bounded event pagination and some stream-quality rollups demonstrate consumers of the reusable telemetry port. Creator earnings, private-show/content-sale analytics, supporter segmentation, dashboard layouts, alerts, and presentation schemas are tenant product/control-plane concerns. Prediction models are already separate packages and do not justify making this API part of the synchronous media substrate.

Reuse verdict: retain tenant control plane. Keep this deployable as an Aphrodite reporting composition surface. Point it at the extracted tenant-safe telemetry read port, then add authenticated roles, durable configuration stores, and real WebSocket sources. Do not extract its route graph, global context, synthetic socket feed, or Aphrodite dashboard schemas. Other tenants can build their own reporting projections over the same shared operational events without inheriting adult monetization policy or a second analytics service.

5. apps/aphrodite/auth#

Role and boundary. This Hono identity API implements registration/login, HS256 access tokens, opaque refresh tokens, password changes/resets, OAuth callbacks, TOTP/backup-code management, authorization middleware, and an uncomposed session service. The server listens on port 3003. Roles and permissions encode Aphrodite user, creator, moderator, administrator, content, stream, and payment policy; no media bytes or session signaling pass through it.

State and integration reality. Repository/store interfaces exist for users, refresh tokens, reset requests, OAuth links, TOTP data, and sessions, but the app and production entry point always install in-memory implementations. The listed database dependency is unused. Process-local maps also hold lockouts, rate limits, revoked access-token IDs, used backup codes, and OAuth state. Some cryptographic primitives are sound in isolation (PBKDF2, HMAC verification, CSPRNG token material, TOTP), but their composed flows are not viable:

• refresh tokens are opaque random hex, yet refresh first calls the JWT decoder, so every issued refresh token is rejected;
• reset tokens are stored with a freshly salted password hash and looked up by a second freshly salted hash, which cannot match;
• the email-verification route accepts any nonempty token and marks an arbitrary supplied user ID verified;
• enabling TOTP updates only the separate 2FA repository, never the auth user's twoFactorEnabled flag; login does not call the TOTP service and merely emits the supplied code in an event when the flag is set; and
• configured JWT issuer and audience are neither placed in nor checked on the token, production secrets fall back to checked-in placeholder strings, and revocation is process-local.

OAuth state is process-local and based on Math.random; callback tokens can be placed in a caller-provided return URL query. The direct server bootstrap also reintroduces wildcard credentialed CORS when no environment origin is set, overriding the factory's default-deny intent. No automated tests exist for any of these security-critical paths.

Generic vs tenant-specific. Authenticated principal/tenant claims and capability checks are mandatory substrate inputs. The identity provider, credential recovery, OAuth account linking, creator/moderator role hierarchy, and payment/content permissions are tenant control-plane policy. Reusing this custom token implementation would couple every product to Aphrodite claims and inherit broken security flows.

Reuse verdict: retain tenant control plane. The substrate should accept a small verified principal contract from a configured identity adapter and enforce tenant/resource authorization at its own boundary; it should not issue end-user credentials. Keep or replace this app within Aphrodite, but do not extract its JWT, repository, OAuth, 2FA, session, or rate-limit implementation. Aphrodite must first add durable stores, secret fail-fast, issuer/audience/tenant claims, end-to-end negative security tests, and corrected refresh/reset/verification/2FA flows before its tokens can authorize shared media operations.

6. apps/aphrodite/broadcaster#

Role and boundary. This port-3100 Hono API is Aphrodite's broadcaster control surface. It manages stream records/keys/settings/lifecycle, broadcaster profiles and schedules, private/group shows and goals, interactive-device registrations, monetization settings, and broadcaster analytics. It is a server application despite the name; it does not capture a camera or encode media.

State and integration reality. The production route seams lazily compose SQL stores over @aphrodite/database, with memory stores used as boundary test doubles. Queries consistently resolve the authenticated user to an owned broadcaster row. Sixty-four focused route/integration tests cover ownership and state behavior, and unmodeled features generally return explicit 501 responses instead of invented success. The media boundary is nevertheless absent. The declared @aphrodite/streaming-core dependency is never imported. Creating a stream generates and stores a key locally; start/stop only update the streams status/timestamps; key rotation only updates the database; playback URLs are nullable values assumed to have been provisioned elsewhere. No call provisions ingest, validates that an encoder connected, starts a pipeline, receives authoritative media lifecycle events, or revokes a key at the ingest edge. The thumbnail capture and physical-device bridge correctly report gaps.

Security and tenancy. The app verifies an HS256 bearer token through an environment secret or injectable verifier and fails closed when a presented token cannot be checked. It extracts only sub; it does not validate or carry a tenant, issuer, audience, broadcaster capability, or token-to-resource tenant binding. The SQL schema is Aphrodite-global and ownership is user-based. Thus the existing boundary is useful Aphrodite authorization evidence but not the multi-tenant substrate contract.

Generic vs tenant-specific. Create/provision, rotate/revoke ingest credentials, start/stop reconciliation, playback endpoint discovery, media health, and lifecycle events are reusable streaming control-plane mechanics. Sensual/explicit flags, token earnings, private/group shows, tip goals, broadcaster KYC/profile policy, blocked users, and interactive adult-device settings are Aphrodite product behavior. The current analytics are product read models over Aphrodite tables, explicitly not wire telemetry.

Reuse verdict: thin tenant adapter. Keep this app and its adult-ring product APIs in Aphrodite, but replace direct stream/key/status mutations with calls to the shared tenant-parameterized stream-control organ. Persist the returned substrate resource ID and project authoritative lifecycle events back into the Aphrodite schema. Extraction must make ingest-key revocation effective at the edge, make start/stop reflect actual pipeline state, and add equivalence tests through this existing route/store boundary. Do not move shows, devices, profiles, earnings, or their database schema into the substrate.

7. apps/aphrodite/cdn#

Role and boundary. This port-3005 Hono API groups reusable object-upload, delivery signing, cache-control, cache invalidation/warming, and CDN metric operations. It provides S3-compatible single/multipart upload flows, CloudFront-style signed URLs/cookies, a lightweight resource token, CloudFront invalidation and CloudWatch metric adapters, plus cache-header middleware. It does not itself serve an HLS/DASH origin, select renditions, or proxy media segments.

State and integration reality. The CloudFront provider and multipart S3 paths call real AWS SDK surfaces through injectable ports. Twenty-eight tests cover CloudFront command/error/metric behavior, multipart create/part/complete/ abort behavior, and honest health responses. Production composition does not use that capability: createApp defaults to MockCDNProvider, and the server entry never supplies a CloudFront provider, so invalidation/warming reports success without touching a CDN and stats remain zero. Upload records, invalidation records, pending batches, and multipart session IDs all default to process-local memory and disappear on restart. Shutdown does not stop cache batching or close provider clients.

The direct single-object presigner is a hand-written approximation rather than the AWS presigner used for multipart parts; its canonical-request digest calls HMAC-SHA256 with an empty key instead of SHA-256, so it is not valid SigV4 proof. The lightweight token similarly hashes payload + secret rather than using HMAC and compares strings non-constantly. Neither direct presigning nor either signing service has automated coverage. publicUrl is constructed from the S3 endpoint even when the bucket is private, and a client can mark a direct upload complete without a storage HEAD/checksum confirmation.

Security and tenancy. Any header beginning with Bearer is accepted and mapped to the same fixed mock user. All protected users can request signatures, purges, and uploads as that identity; only full invalidation checks a role, which the mock never grants. Status, completion, failure, abort, progress, and delete routes accept an arbitrary upload ID without verifying its owner. Object keys contain a user ID but no tenant ID, resource policy, or media classification. The direct server also overrides default-deny CORS with wildcard credentialed CORS and defaults to well-known MinIO credentials.

Generic vs tenant-specific. Provider-neutral object keys, durable upload lifecycle, official presigning, signed playback grants, cache profiles, purge batches, and CDN health/metrics are reusable delivery mechanics. Aphrodite's content categories, user identity, authorization rules, retention/moderation decisions, and public/private entitlement policy must enter through tenant adapters. The current upload API is broader than the streaming core and should not imply that it already delivers adaptive live video.

Reuse verdict: extract organ. Extract provider ports and the verified S3/ CloudFront mechanics into a tenant-required storage/delivery organ. Replace the custom signatures with official/verifiable primitives, bind every object and operation to tenant plus resource ownership, persist resumable state, verify object completion, and make provider readiness fail closed. The shared stream pipeline can then ask this organ for origin/object locations and scoped playback grants. Keep Aphrodite routing/category/policy in a thin adapter, and retain provider integration tests as equivalence evidence; the current mock-composed app is not production delivery evidence.

8. apps/aphrodite/chat#

Role and boundary. This port-5000 Hono plus Socket.IO service provides stream-room chat, presence/typing, message history/search/deletion, live and durable moderation surfaces, and one-to-one direct messages. A chat room is defined as an Aphrodite streams row. Socket messages and DMs write through the same SQL store ports used by REST; memory implementations serve as boundary doubles.

State and integration reality. Production messages, room views, direct messages, blocks, and selected moderation history use real Aphrodite tables. Socket handshakes fail closed and derive identity/roles from a verified shared HMAC envelope rather than client-authored claims. Seventy-one tests cover REST behavior, socket auth tampering/expiry, DM persistence/authorization, moderation authorization/clearing, and content-filter edge cases. The realtime plane is single-node: connected users, rooms, broadcasts, typing, filters, duplicate/ slow-mode state, and socket mutes/timeouts live in process memory, with no Socket.IO cluster adapter or distributed presence/rate-limit store.

Moderation has two inconsistent authorities. REST bans persist to viewer_blocks but none of the socket join/send checks query that store; socket bans/mutes use a separate memory map and are not persisted. Filter configuration is public, mutable, and memory-only. Room join accepts any supplied ID without checking that the stream exists or that the principal is entitled, although the later message insert can fail for a missing stream. The content filter is called without userId, disabling its per-user duplicate-message check. A client may also label any socket message as a tip and supply any amount, which is persisted as a TIP chat row without payment evidence.

Security and tenancy. WebSocket authentication is the strongest boundary in this app, but its token contract has no tenant claim and trusts embedded global/ room role strings. The entire REST API has no authentication middleware: DMs and deletion trust a caller-controlled x-user-id, and ban/filter mutations have no identity or role check at all. SQL rows are keyed by globally assumed stream/user IDs, not tenant plus resource. Multi-node delivery, membership, and moderation therefore cannot currently preserve isolation or consistent policy.

Generic vs tenant-specific. Authenticated room membership, ordered durable messages, bounded history, presence, fan-out, rate limiting, deletion events, and moderation hook ports are reusable live-session mechanics. Direct messages, client presentation events, tip highlights, filtered-word policy, subscriber/ follower access, moderator assignment, and sanctions are tenant product policy. The substrate must never infer a payment from a chat payload.

Reuse verdict: extract organ. Extract stream-room chat behind tenant-required principal, session, membership, persistence, fan-out, and policy-provider ports. Unify REST/socket authorization and the moderation source, require a real stream session before joining, add distributed adapter/state support, and accept tip or system messages only as authenticated server events. Keep Aphrodite DMs, adult-ring filters/sanctions, and user-facing schemas in a thin adapter. Run the existing store/socket tests against both the adapter and shared organ, adding cross-tenant, reconnect/order, multi-node, and policy-denial equivalence cases.

9. apps/aphrodite/devices#

Role and boundary. This port-4003 Hono plus Socket.IO application is an intimate-device gateway. It exposes pairing metadata, device status, custom and built-in motion patterns, funscript conversion, tip-to-pattern triggers, and live commands for Lovense, Buttplug/Intiface, Kiiroo, Handy, OhMiBod, and T-Code serial devices. Media is neither ingested nor delivered; only the Handy/funscript features conceptually synchronize an external actuator with content time.

State and integration reality. Several protocol classes contain genuine HTTP, WebSocket, Intiface, and serial-port translations. The composed service does not connect REST pairing to them: devices/credentials are held in one module-level memory map, patterns and triggers in singleton memory managers, and live sessions/devices in another memory graph. The WebSocket manager constructs each shared protocol handler with an empty config, so user tokens, Handy keys, serial paths, and cloud endpoints captured by REST never reach it. Consequently most cloud discovery returns empty, while local-network/Intiface/serial discovery runs on the server host rather than the remote user's machine. The listed database dependency is unused and all pairing/trigger/custom-pattern/session state vanishes on restart. Disconnected sessions are retained indefinitely.

Sixty-six tests cover extensive REST shapes and signed WebSocket identity, but there is no vendor contract, hardware-in-loop, REST/socket composition, safety stop, reconnect, or payment-event authenticity coverage. Several protocol success responses mean only that a command was sent, not acknowledged by a device. The HTTP health surface does not probe a device bridge or durable store.

Security and tenancy. Socket identity fails closed and comes from a signed token, but carries only a global user ID/roles. REST operations trust an arbitrary x-user-id header. The Socket.IO server defaults to wildcard CORS. Most critically, the authenticated device owner can submit an arbitrary tip:process event, including its amount and recipient, and thereby activate hardware without an authoritative payment event. Shared protocol-handler maps and global tip callbacks also lack an explicit tenant/owner partition.

Generic vs tenant-specific. A generic live-media substrate may publish authenticated timecode, stream-lifecycle, or monetization-domain events through narrow hooks. Vendor pairing, intimate-hardware commands, patterns, consent and intensity limits, funscript semantics, and tip automation are a separate high- risk Aphrodite product domain. Moving them into streaming core would expand both the safety boundary and every other tenant's dependency surface.

Reuse verdict: retain tenant control plane. Do not extract this service into the streaming substrate. Aphrodite should first move hardware control to an appropriate user-local bridge, persist consent/pairing/trigger policy, replace spoofable REST identity, consume payment events only from a verified service, and prove fail-safe stop/reconnect behavior. The shared substrate should expose only optional tenant-tagged session/timecode hooks; this app remains one consumer and cannot influence ingest, playback authorization, or core session lifecycle.

10. apps/aphrodite/mobile-broadcaster#

Role and boundary. This package is a React Native creator application: it contains home, stream setup, camera/control, chat/moderation, analytics, and settings screens plus client-side portrait, face-tracking, notification, and background-image bridges. Capture and encoding necessarily run on the creator device, but this surface is not a server-side ingest, session, or delivery organ. Its adult categories, tips/revenue display, chat policy, beauty effects, and creator workflow are Aphrodite presentation and product behavior.

Execution and integration reality. The repository explicitly records the package as TypeScript-only: there is no Android or iOS project, app registry, Metro/Babel setup, Detox configuration, or end-to-end test. The declared React Native build and Detox targets therefore cannot run. More importantly, every publisher method in StreamingService is an empty native-module stub, including permissions, camera preview, encoder configuration, RTMP connection, publish/mute/stop, health collection, adaptive bitrate, effects, snapshots, and local recording. These no-ops still advance the local session to live and return constant healthy metrics, so the state machine can falsely report a successful broadcast without capturing or sending a frame.

There is no control-plane provisioning path. StreamScreen initializes both the stream key and RTMP URL to permanent null values and exposes no setter; StreamSetupScreen collects settings but neither configures the service nor passes data and only navigates backward. No route calls an API to create a stream, obtain a scoped ingest grant, acknowledge connection, discover playback, or stop the server session. The on-screen camera area is a text placeholder. The chat service similarly marks itself connected while all Socket.IO connect, send, moderation, poll, ping, and persistence hooks are no-ops. Analytics is the sole real network client, hard-coded to https://api.aphrodite.app, but its bearer token initializer is never called, so it sends Bearer null and silently falls back to empty data after failures. Several auxiliary native bridges have explicit JS fallbacks, but there is no native shell that could supply their modules.

Evidence and risk. Ninety-three tests cover only background-image, depth, face-tracking, notification, portrait-segmentation, and their service wrappers. There is no automated coverage for the publisher, stream screens, credential lifecycle, chat transport, analytics authentication, or a runnable mobile flow. The screen cleanup also captures the initial idle status in an empty-dependency effect, so unmount does not reliably end a later live session. In-memory stream keys are included in returned session objects without a modeled secure-storage or redaction boundary. These facts make this scaffold neither working- publisher evidence nor an equivalence oracle for extraction.

Generic vs tenant-specific. A reusable client contract should obtain a short-lived tenant/session-bound ingest grant, configure an actual platform publisher, report authoritative connection/health transitions, reconcile stop and reconnect with the control plane, and keep credentials out of logs and durable client state. Its platform-specific implementation may be delivered as a shared broadcaster SDK/adapter consumed by multiple apps. Screen layout, adult categories and access settings, tips, moderation controls, creator analytics, visual effects, and notification presentation remain Aphrodite-owned.

Reuse verdict: client of substrate. Do not move this React Native app or its simulated services into the server substrate. Replace StreamingService with a real, fail-closed publisher adapter behind the shared client contract and have an authenticated Aphrodite control-plane adapter provision/revoke the substrate session. Only then can native-shell builds, device/simulator automation, network interruption tests, and server-observed media/lifecycle assertions establish equivalence. The shared substrate owns the grant and authoritative session; Aphrodite continues to own this creator experience and its product policy.

11. apps/aphrodite/mobile-viewer#

Role and boundary. This package is intended to be Aphrodite's React Native viewer client, with local service abstractions for adaptive playback, chat, tipping, offline downloads/background playback, and cardboard/WebXR viewing. It contains no deployable server or server-side media mechanics. Viewer presentation, mature/subscriber labels, tips and gifts, emotes, offline UX, and VR controls are tenant product concerns; playback-session acquisition and health reporting are its potential shared-client boundary.

Execution and composition reality. Only five service classes and type files exist. There is no App.tsx, screen, navigator, app registry, native bridge, Android/iOS project, Metro/Babel configuration, or Detox configuration, even though the copied scaffolding note says that app/screens/bridges exist and the Nx targets advertise native and end-to-end builds. The package is therefore neither a runnable app nor an integration of the services it exports.

StreamingService accepts an arbitrary caller-supplied streamUrl and then implements every player operation as a no-op: load/play/pause/seek/quality, PiP/background mode, low-latency catch-up, progress, buffer, latency, and retry. It reports playing, returns successful PiP, reports zero latency, and starts timers over empty buffer/progress data without invoking react-native-video. The local ABR algorithm never receives a bandwidth sample because its update method has no caller. There is no authenticated discovery request, scoped playback grant, entitlement/age/subscriber enforcement, manifest validation, DRM license exchange, or server-observed viewer lifecycle. The mature and subscriber-only fields are descriptive booleans only.

Chat likewise "connects" using only caller-supplied user and stream IDs while all transport, status, emote, message, vote, and heartbeat methods are stubs. Tipping returns client-manufactured success, locally subtracts a zero/default balance, exposes a placeholder payment secret, and confirms payment without a processor or server. Offline download code fetches a hard-coded example segment but its file, persistence, storage, background-audio, metadata, manifest, and subtitle operations are simulated; it can register an in-memory offline item without writing media or enforcing the declared DRM key/expiry. The VR class contains standalone geometry and sensor calculations but uses browser globals (navigator, window, document, WebXR) inside a nominal React Native package and never binds a video texture or the playback service.

Evidence and risk. There are no unit, integration, component, native, or end-to-end tests; Vitest is configured to pass with zero tests while the Nx and package test commands invoke Jest without a local configuration. No flow proves authorized playback, rendition switching, interruption recovery, latency, offline bytes/DRM, commerce authenticity, chat identity, or VR rendering. As with the broadcaster scaffold, local success states must not become shared contract evidence.

Generic vs tenant-specific. A reusable viewer SDK may acquire a tenant- and session-bound playback grant, pass signed manifest/license data to a real platform player, surface native quality/buffer/latency events, report lifecycle, and fail closed on entitlement or expiry. A separate reusable renderer adapter could consume decoded frames for flat or immersive clients. Aphrodite still owns discovery, adult eligibility and subscription policy, tipping/gifts, chat presentation, downloads policy, and viewer/VR UX; authoritative commerce stays outside a media client.

Reuse verdict: client of substrate. Do not extract this package's simulated state machines into the server substrate. Define the shared playback/session client contract independently, then make an authenticated Aphrodite app consume it through a real native player and policy adapter. Equivalence requires a runnable native shell plus device automation that observes authorized manifests, decoded media, true player telemetry, revocation/expiry, reconnect, and cross- tenant denial. This package currently supplies vocabulary and risk inventory, not reusable implementation proof.

12. apps/aphrodite/notifications#

Role and boundary. This Hono notification application models in-app, FCM push, SendGrid email, and nominal SMS delivery, including preferences, quiet hours, aggregation, deduplication, retry queues, expiry cleanup, and Socket.IO fan-out. Its event taxonomy is Aphrodite product policy: follows, tips, shows, tickets, messages, subscriptions, gifts, creators going live, announcements, system notices, and moderation. It consumes lifecycle/business events after the fact; it is not part of ingest, media processing, playback, or synchronous session signaling.

State and delivery reality. The core has several genuine reusable mechanics. PostgresNotificationRepository supplies schema-backed notifications, preferences, and SKIP LOCKED queue claims; FCM and SendGrid adapters call real provider surfaces through injectable ports; transport failures are retried and are no longer fabricated as successful sends. Ninety-four tests cover the core queue, SQL generation/mapping, push batches and invalid tokens, email templates/ signatures/provider errors, app email wiring, and socket handshake identity.

The deployable composition does not use that durable path. createApp always constructs in-memory notification and push-subscription repositories and offers no repository injection option. No route registers device subscriptions. The package start command executes dist/index.js, but src/index.ts is only an export barrel: it binds no HTTP listener, constructs no Socket.IO server, calls neither initialization nor shutdown, and never installs the exported WebSocket handler. There is also no bootstrap that reads database, Firebase, SendGrid, recipient-directory, CORS, or stable unsubscribe-secret configuration. In the default graph, push sees zero process-local devices and treats that as a successful no-op, email has no address resolver/deliverer, SMS has no deliverer, and every notification/preference/queue entry disappears on restart.

Security and tenancy. Every HTTP create, batch, read, stats, read-all, dismiss, delete, and preference route is unauthenticated and accepts arbitrary user IDs; notification-by-ID responses expose the complete payload. The socket handshake correctly fails closed and derives a user from a signed envelope, but the token has no tenant claim. Its item-level mark-read, dismiss, and delete handlers call ID-only service methods and never check that the notification belongs to the authenticated user. Neither in-memory nor SQL rows carry a tenant key. Provider payload metadata and action URLs therefore cannot safely be accepted from the current public producer boundary.

Generic vs tenant-specific. Durable outbox/queue claiming, provider ports, retry/error accounting, device-subscription storage, and authenticated in-app fan-out are broadly reusable notification infrastructure, but they form a separate asynchronous messaging subsystem rather than a media organ. Notification types, templates, channel selection, quiet-hours semantics, adult-show/tip/ moderation content, recipient resolution, and audience policy belong to the tenant. The streaming substrate should only emit a versioned tenant-tagged session/lifecycle event that an authorized notification adapter may translate.

Reuse verdict: retain tenant control plane. Keep this service outside the streaming substrate and have Aphrodite consume shared stream.live, ended, or similar lifecycle events through a narrow, idempotent adapter. Before it can do so in production, add a real bootstrap, durable repository/subscription composition, authenticated producer and owner-scoped consumer routes, tenant keys and cross-tenant denial tests, stable secret/provider configuration, Socket.IO composition, and durable event/idempotency handling. Provider mechanics may later move to a general notification platform package, but RB.3 must not couple the media stack to Aphrodite's messaging policy.

13. apps/aphrodite/payment#

Role and boundary. This runnable port-4000 Hono service owns Aphrodite token purchases and balances, tips and creator goals, subscription tiers, payouts, derived transactions/earnings, and signed provider/internal webhooks. These are commerce and entitlement-source domains, not media transport. A stream ID is optional attribution on tips/show transactions; no ingest, playback, manifest, or live-session operation is performed here.

State and implementation reality. Unlike many audited scaffolds, production routes lazily compose real @aphrodite/database SQL stores. Tip debits, fee splits, creator credits, and goal updates are transactional; payout request/ cancel and purchase completion/refund move ledger state atomically; subscription stores enforce tier and lifecycle constraints; provider and internal webhook paths fail closed when signing secrets are absent. Unmodeled transfer, hold, refund, billing-history, payout-method, tax, verification, fraud-review, and report-file surfaces generally return explicit 501 responses rather than invented records.

Important money flows are still incomplete. Purchase initiation writes a pending row but does not create a checkout with CCBill, Segpay, Stripe, PayPal, or return a provider URL. PayPal verification is explicitly a shared-secret HMAC stop-gap rather than PayPal's server-side verification protocol; CCBill and Segpay similarly assume local raw-body HMAC conventions. Payout requests only reserve internal tokens; no payout-provider worker is composed. Most critically, the subscription route immediately inserts/reactivates an ACTIVE subscription and increments subscriber counts without debiting tokens, creating a provider charge/session, or waiting for a verified payment event. Such a row cannot authorize subscriber-only playback.

Security and tenancy. There is no authentication or authorization middleware anywhere in the app. The tests' x-user-id header is unused; routes instead trust path and body IDs. A public caller can spend another viewer's balance by sending a tip, create or cancel another viewer's subscription, create or mutate a creator's tiers/goals/tip menu, request or cancel a broadcaster's payout, and read balances, earnings, subscribers, payout details, and ledgers. Optional stream IDs on tips are not checked for existence, tenant, entitlement, or broadcaster ownership. No row or principal includes a tenant dimension, and the advertised idempotency header is never consumed, so duplicate client money requests are not protected by an API idempotency key.

Evidence. One hundred six route tests exercise broad behavior, honest model gaps, fee arithmetic, lifecycle guards, webhook signatures/replay tolerance, and memory-store idempotence. Despite the integration filename, the suite injects memory stores for every money domain and mocks database health. It does not execute SQL stores against Postgres, any provider sandbox/contract, payout worker, authenticated owner/capability checks, idempotency races, or cross- tenant denials. The type ratchet is clean, but that is not financial or entitlement equivalence evidence.

Generic vs tenant-specific. The substrate needs only a narrow, tenant-bound entitlement decision/grant input and may emit authenticated session facts for billing adapters. Token economics, adult private/group/spy show purchases, tips, intimate-device triggers, subscription tiers, revenue share, provider choice, payouts, tax/compliance, and dispute policy remain Aphrodite commerce. Even reusable payment-ledger/provider mechanics belong in a separate commerce platform, never in the synchronous media core.

Reuse verdict: retain tenant control plane. Keep this service outside the streaming substrate. After adding verified principals/capabilities, owner- and tenant-scoped SQL, real checkout/payout/provider verification, API idempotency, and database/provider/negative-security tests, Aphrodite may issue a short-lived entitlement assertion through the substrate's configured policy adapter. The substrate must fail closed and independently bind that assertion to tenant, principal, stream, access mode, and expiry; it must not trust today's public subscription rows or client-authored tip/stream associations.

14. apps/aphrodite/realtime-analytics#

Role and boundary. This runnable port-3450 HTTP/WebSocket service tracks live viewer sessions/counts, revenue, chat/tip/reaction engagement, trends, and dashboard snapshots. Viewer session accounting and bounded live operational metrics are close to the shared streaming plane. Revenue, top tippers, subscriber/follower signals, sentiment, and creator engagement are Aphrodite product projections layered on those session facts.

State and integration reality. All viewer sessions, unique-viewer sets, transactions, creator revenue, engagement windows, trend histories, socket clients, and IP counts live in singleton process memory. Restart loses every fact; multiple replicas compute divergent counts. Redis-capable pub/sub exists as a separate event bus, but the service classes emit only on their own EventEmitters and never publish into it. Conversely, EventBus.subscribe() never calls subscribeRedis(), and no composition code does, so the Redis subscriber joins no channels. The WebSocket forwarders therefore do not receive HTTP-ingested service events through that bus; only periodic socket snapshots read the local maps.

The HTTP ingestion routes are the sole source for viewer, transaction, chat, tip, and reaction facts, and callers supply every identity and classification. Viewer join trusts isAuthenticated, isSubscriber, tier, country, creator, stream, viewer, and session ID. Reusing a session ID can overwrite the global session while leaving a stale entry in the former stream map; heartbeat ignores the submitted viewer/stream relationship. Revenue has no transaction-ID deduplication, so retries double-count and a refund finds only the first match. No route reconciles against an actual stream/session, edge connection, payment, chat, or durable analytics ledger.

Security and accuracy. HTTP reads and event writes have no authentication, authorization, rate limit, tenant, or resource membership check. WebSocket connections likewise accept a caller-selected client ID and arbitrary stream/ creator subscriptions. The handler casts messages instead of applying the declared subscription schema, so the 100 ms minimum interval is unenforced and an attacker can create extremely tight timers. Revenue and per-creator data are public. Production CORS falls back to wildcard with credentials when the origin allowlist is empty. WebSocket stream snapshots also hard-code a healthy 4.5 Mbps, 30 fps, 1% drop rate, and 2.5-second latency plus zero duration rather than reading a media pipeline; health endpoints label every singleton healthy without probing Redis or an authoritative source.

Evidence. Twenty-five tests cover only engagement sentiment/reaction classification and provider fallback behavior. There is no automated coverage for viewer session lifecycle, duplicate/reordered events, revenue/refunds, HTTP authorization, event-bus/Redis delivery, WebSocket validation/isolation, multi-node aggregation, restart recovery, or synthetic media-health claims. The declared @aphrodite/analytics dependency is not composed into durability or reconciliation.

Generic vs tenant-specific. Authoritative join/leave/heartbeat accounting, tenant/session-tagged operational events, bounded recent windows, distributed aggregation, and scoped live-metric subscriptions are reusable streaming mechanics. Revenue sources, supporter rankings, adult commerce, chat sentiment, creator dashboards, country/tier presentation, and engagement scoring stay in Aphrodite projections. Media health must originate from ingest/packager/player telemetry, not a reporting default.

Reuse verdict: extract organ. Extract the viewer/session and operational telemetry contract, not this public singleton deployment. Require authenticated internal producers, server-issued session IDs, tenant/resource binding, idempotent sequence/event IDs, durable or reconstructable state, a real distributed aggregation design, schema-validated authorized subscriptions, and authoritative pipeline health. Bridge shared events to Aphrodite's revenue and engagement projections outside the organ. Preserve current pure calculations only where new replay, cross-tenant, multi-node, reconnect, and lifecycle equivalence tests prove them.

15. apps/aphrodite/streaming#

Role and boundary. This runnable port-3003 Hono application is named as the core streaming service, but its implemented production boundary is an Aphrodite SQL control/read API. It creates and edits streams rows, rotates and validates ingest keys, applies a stored lifecycle state machine, handles RTMP server auth/publish callbacks, reads provisioned playback/thumbnail URLs and completed recordings, and exposes Aphrodite discovery queries. It does not run an RTMP server, WebRTC SFU, encoder, packager, origin/CDN, recorder, frame capture worker, or media-observability pipeline. Those route families generally return explicit 501 gaps; the advertised gRPC and graceful media shutdown paths are TODOs. The declared @aphrodite/streaming-core dependency is unused.

State and media reality. The production route seams lazily construct real @aphrodite/database stores. The stream state machine validates the current SQL row, CSPRNG stream keys replace the earlier accept-any-key scaffold, RTMP auth joins broadcaster status, catalog queries and completed-recording reads are real, and readiness probes Postgres while marking Redis, Kafka, MediaSoup, and transcoding unprobed. Those are useful control-plane mechanics, not evidence of a media path. start, stop, and publish callbacks only mutate SQL state; no provisioning or teardown is attempted and no media observation proves a stream live. HLS, WebRTC, and thumbnail routes merely echo nullable URL columns that some external system must populate. The fixed ABR ladder has no worker behind it, while ingest selection, transport negotiation, transcoding jobs, playlist and token generation, recording/export/DVR, thumbnails, and QoE all fail loud.

The separate /metrics tree is actively misleading: it returns fabricated zero counters and labels the database, Redis, Kafka, MediaSoup, transcoding, and the service healthy without probing any of them, contradicting /health/ready and /health/stats. Stream/viewer statistics otherwise mix stored counters and view_sessions/chat rows rather than authoritative edge/player sessions.

Security and tenancy. The global middleware recognizes an internal API key only by setting isInternalCall; no route checks that flag, bearer identity, role, ownership, or capability. As a result, public callers can create streams for any broadcaster, read or edit full stream records, change lifecycle state, rotate or retrieve keys, invoke ingest publish/done callbacks, delete recordings, read storage/catalog data, and enumerate playback assets. Full stream records include the plaintext streamKey; SQL stores the key plaintext and compares it directly. Publish callbacks accept only a caller-supplied stream ID and are not bound to a successful auth decision or trusted edge. No schema, context, query, or event contains a tenant key. The process-local rate limiter keys on a spoofable service/forwarded header and cannot supply either authorization or distributed protection.

Evidence. Thirty-seven tests cover the memory-store stream state machine, exact-key matching, broadcaster-status gating, catalog and recording reads, stored asset reads, explicit infrastructure gaps, and the honest health routes. Despite the integration filename, the main suite injects memory stores and mocks database health. No test exercises Postgres, authenticated ownership or internal-callback capabilities, secret redaction/storage, tenant isolation, concurrent transitions, a media server callback contract, provisioned media, playback, recording artifacts, or real metrics. The suite also codifies returning the ingest key in ordinary create responses without testing who may receive it.

Generic vs tenant-specific. Tenant-bound ingest grants, authoritative media lifecycle events, publisher/session control, provisioned playback endpoints, rendition and artifact metadata, recorder control, health, and operational telemetry belong in the shared substrate. Aphrodite broadcaster/category/tag/ maturity discovery, catalog ranking, product stream metadata, viewer and tip rollups, completed-content policy, and database projection remain tenant control plane. A shared organ should issue hashed or otherwise safely managed, scoped, revocable ingest credentials and signed playback grants rather than expose this row model.

Reuse verdict: thin tenant adapter. Keep this app as the Aphrodite catalog and policy adapter, but replace its self-declared lifecycle/key/media route behavior with authenticated, tenant-parameterized substrate commands, queries, and events. Do not extract the current route graph or SQL status mutations as a media organ: they are a consumer-side projection with no underlying media implementation. Extraction should instead converge on the adjacent reusable media libraries and a new shared contract, then prove publisher-to-player, revocation, callback authenticity, artifact, telemetry, failure, and cross- tenant equivalence before Aphrodite delegates authority to it.

16. apps/aphrodite/viewer#

Role and boundary. This runnable port-3002 Hono service is Aphrodite's viewer-facing backend-for-frontend. It combines live catalog/search, SQL view sessions and stored playback URLs with chat/DMs, tips, follows/subscription reads, viewer settings, interactive-device commands, private/group shows, viewing history, and notifications. It composes real SQL stores lazily by default and generally returns explicit model/domain gaps instead of fabricating unsupported player, ticket, clip, push-delivery, or account behavior. It is therefore a substantive tenant application, but it neither plays nor delivers media and should not become the shared viewer service wholesale.

Viewing and state reality. join checks that a stream row is live, applies the Aphrodite sensual-tier opt-in and broadcaster ban, inserts a view_sessions row, increments denormalized viewer counters, and returns the row's nullable HLS/WebRTC URLs. leave closes the most recent matching row and updates watch time. There is no substrate/edge call, signed playback grant, entitlement or access-mode decision, session lease/heartbeat, URL expiry, license/DRM binding, media confirmation, or player telemetry. Missing URLs still produce a successful join. Session insert and counter update are separate queries rather than a transaction; repeat joins create multiple open sessions, abandoned sessions have no expiry/reconciliation path, and leave closes only one. The declared chat, payment, device-protocol, and core package dependencies are unused—the app directly duplicates database-domain logic instead of composing their authoritative services.

Identity, authorization, and tenancy. The middleware verifies an HS256 signature only when a local shared secret is configured and puts JWT sub in a variable named userId. The Aphrodite auth service signs users.id as sub. Settings correctly selects viewers.user_id, but nearly every other SQL store uses the same value directly as viewers.id/viewer_id. Production tokens therefore address the wrong identifier for sessions, chat, tips, follows, notifications, devices, history, and show participation; memory tests hide the mismatch by using one interchangeable string. The verifier does not enforce issuer, audience, role, tenant, or the auth service's process-local revocation state. No tenant key exists in request context or SQL predicates.

Even after identity mapping is corrected, join does not check viewer status, ban/age state, subscription or paid-show participation, and chat send does not require a live stream or active viewing session. Any authenticated viewer can inspect and command any broadcaster device whose global allow_viewer_control flag is set; no stream/session or tip grant is required. Tips are at least atomically debited and split, but lack API idempotency. Show request/join flows split balance deduction, request/participation insertion, and compensating refund across independent operations; failures and races can strand or duplicate funds, and extensions debit without recording the extra entitlement. These are tenant commerce/control defects, not mechanics to extract into media.

Evidence. One hundred thirty-one tests cover broad route behavior, memory store lifecycle and policy calculations, owner-scoped reads, model gaps, and database-health branching. No test instantiates a SQL store or Postgres, and the integration suite injects a token verifier plus memory stores. It does not test the real auth-token-to-viewer-row mapping, revocation/issuer/audience, tenant isolation, transactional session races, abandoned-session reconciliation, entitlement or grant expiry, signed manifests, media playback, viewer QoE, database commerce atomicity, or a device bridge. The breadth is useful product regression evidence but not publisher-to-viewer equivalence.

Generic vs tenant-specific. Authenticated tenant/principal resolution, entitlement evaluation, short-lived playback grants, server-issued leased view sessions, authoritative join/leave/reconnect events, playback endpoint and rendition metadata, and scoped viewer telemetry are reusable substrate contracts. Aphrodite's discovery ranking, sensual-tier preference, broadcaster bans, chat/DM presentation, token/tip/show economics, follows, notifications, device-control policy, schedules/VOD catalog, profiles, and history projections remain tenant control plane. Shared chat/session organs can expose narrow ports; they must not inherit this database schema or commerce coupling.

Reuse verdict: thin tenant adapter. Retain this deployable as Aphrodite's authenticated viewer API and policy composer. Replace direct playback URL and session authority with a tenant-bound substrate join/heartbeat/leave flow after resolving users.id to the tenant's viewer principal and obtaining a real entitlement decision. Project authoritative substrate events back into Aphrodite history, discovery, notifications, and commerce. Do not extract its combined route graph: only the generic viewer-session/grant contract belongs in the shared stack, proven with SQL identity, duplicate/reconnect, expiry/ revocation, cross-tenant denial, real player, and failure-path tests.

17. apps/aphrodite/vr#

Role and boundary. This runnable port-3008 Hono/Socket.IO service presents VR capture configuration, projection/stereo/spatial-audio metadata, headset capabilities, playback-session state, head tracking, interactions, settings, and adaptive-quality calculations. Its domain vocabulary is largely generic immersive media, making it the most direct candidate for a shared VR organ. The current implementation, however, is a control-plane simulation: it never opens a camera, stitches frames, encodes video/audio, publishes ingest, provisions a VR rendition, obtains a manifest, decodes/renders media, or applies tracking to viewport/foveated delivery.

State and media reality. Capture initializes a metadata record in process memory, optionally mirrors JSON to an injected Redis port, installs a spatial- audio configuration object, and accepts caller-authored encoder statistics. Its audio module performs vector/source calculations but no audio processing. Playback similarly creates memory sessions for any supplied stream ID, stores client tracking/interactions/metrics, and changes a string quality preset; no stream existence, grant, asset, rendition, player, or edge is consulted. Manual WebSocket quality selection merely echoes quality:changed without changing session state. Session statistics hard-code 90% active viewing, zero pauses and quality switches, and 60 fps. The HTTP preset routes return empty lists despite an in-package preset catalog.

Redis and database dependencies are listed but production constructs both services with only a logger, so every stream, session, setting, interaction, tracking sample, and metric is process-local and lost on restart. Even if Redis were injected, per-stream session indexes and several local histories are not reconstructed consistently across replicas. Local EventEmitter events have no durable bus. Readiness is unconditionally true; detailed health labels service objects healthy without probing their functionality.

Security and tenancy. Every HTTP capture/playback route is public. A caller can create, enumerate, mutate, or stop another claimed user's stream; read or overwrite any user's settings; start, inspect, pause, alter, or end arbitrary sessions; retrieve head tracking/device capabilities; and inject metrics, interactions, or capture statistics. This includes sensitive IPD, headset, tracking, optional location, and device data. Stream and user IDs are entirely client asserted, and there is no entitlement, ownership, resource membership, rate limit, or tenant dimension. Production HTTP and WebSocket CORS default to * while HTTP credentials are enabled, and the global error handler returns raw exception messages.

The Socket.IO boundary is better: its short-lived HMAC envelope now fails closed and derives userId from the signature instead of session:start. However, the shared envelope has no tenant, audience, issuer, or resource grant; roles are ignored here. Any signed user can start a session for an arbitrary or nonexistent stream. Socket event payloads bypass the HTTP Zod schemas and lack runtime validation/rate bounds, so tracking batches and metrics are trusted.

Evidence. Four tests cover only token round-trip/failure, rejection without a valid verifier, signed-user selection, and missing-secret fail-closed behavior using fake Socket.IO/services. There are no tests for capture/playback services, HTTP routes, Redis behavior, multi-node/restart recovery, projection/audio or quality correctness, authorization/ownership/tenancy, payload abuse, health, actual encoding, an immersive manifest, decoded frames, head-tracked rendering, comfort/latency, or hardware/WebXR. The Vitest comment still says no tests exist and permits that condition, underscoring the absence of media equivalence.

Generic vs tenant-specific. VR projection/stereo/spatial-audio descriptors, validated rendition capabilities, headset capability normalization, safe quality recommendations, viewport/tracking telemetry schemas, and immersive asset/ session negotiation are reusable substrate concerns. Preset tables and pure math can seed that organ after standards/hardware validation. Aphrodite still owns adult eligibility and entitlement, content metadata/location disclosure, viewer privacy/consent, settings presentation, interaction semantics, discovery, and product analytics. Headset detection, comfort settings, and rendering logic primarily belong in shared client SDK adapters, not a server pretending to play media.

Reuse verdict: extract organ. Extract the generic immersive media contract and independently verified pure capability/projection/quality logic, not this public memory deployment. Fold VR descriptors and rendition negotiation into the one shared ingest-to-playback substrate; require tenant-bound publisher and viewer grants, real capture/encoder/packager/player adapters, authoritative telemetry, bounded schema-validated tracking, durable/distributed session semantics, privacy controls, and honest health. Keep a thin Aphrodite adapter for policy and metadata. Equivalence must observe real 180°/360° stereo and spatial-audio playback on supported hardware or a credible automated harness, including reconnect, downgrade, revocation, failure, and cross-tenant denial.

Increment 7j implementation update (2026-07-19). The insecure deployment described above is no longer mounted: apps/aphrodite/vr now serves only an explicit 410, no-store retirement gateway with default-deny CORS and honest retired health. Its old exports remain temporarily source-compatible but its entry point constructs no simulated capture, playback, tracking, or Socket.IO authority. The reusable implementation moved into the canonical substrate: @oshun/live-media/browser now renders protected equirectangular 180°/360° mono/SBS/top-bottom video through WebGL in bounded flat/cardboard modes, uses pointer/keyboard/device-orientation input, and measures Web Audio plus non-black pixel and changed-view evidence. Aphrodite Viewer composes that client with the durable aphrodite.immersive.v1 adapter over migration 00020 and the exact succeeded browser-player/viewer/publication binding. Real FFmpeg/Chromium HLS and DASH automation covers 360° device orientation, 180° pointer orientation, two distinct non-black eye buffers on paused source frames, stereo audio, axe, mobile/reduced motion, privacy, and ordered teardown. The real PostgreSQL gate covers restart replay, expired-lease recovery, stale-worker fencing, RLS tenant denial, revocation-driven release, and durable credential/raw-tracking non-disclosure. This supersedes the earlier evidence paragraph for the deployed VR app, but it does not claim camera/stitching, cubemap/EAC, ambisonics, WebXR, OpenXR, visionOS, comfort certification, or physical headset validation.

Adjacent-library scope and method#

libs/aphrodite contains 192 top-level package directories. Reading all 192 as if they were media infrastructure would obscure the extraction boundary with payments, identity, games, ritual, compliance, production planning, rendering, and product UI. The adjacent pass therefore included each package that owns or claims one of the following responsibilities: ingest/publisher capture, composition, encoding or recording, media delivery, viewer sessions, live chat, presence, notification/telemetry hooks, media storage, content protection, or immersive-media capture/playback. That rule selected the 36 packages below.

The pass read package/build manifests, public exports, implementation files, production defaults, external-I/O use, and tests. A package with many tests or media-shaped types was not treated as a working organ unless its runtime actually moves media or durable authoritative state. Conversely, genuine browser processing and low-level codec/container code are recorded as reusable client or execution kernels even when they do not belong in a server control plane.

The remaining 156 directories are out of the initial synchronous substrate by responsibility, not silently unaudited by name. Examples include:

• tenant control planes and policy: age-verification, compliance*, consent-engine, content-takedown, database, payment*, ppv, revenue-sharing, and safety*;
• production and presentation: production, audience-experience, immersive-theater, virtual-rooms, auteur-camera, cinematic-camera, performer-camera, scene packages, and avatar/VFX packages;
• post-live/VOD products: archive and vod-chaptering; and
• peripherals and tenant experiences: device-*, haptics*, vr-haptics, games, gifts, tips, and venue packages.

Those packages may consume versioned live-media events or client frame APIs. They do not get authority over ingest, playback grants, viewer leases, media objects, or core session state merely because they react to a live stream.

Adjacent library extraction map#

Increment 7k implementation update (2026-07-19). The remote-guest row above records the pre-extraction audit and is now superseded at its production boundary. The unsafe token-in-query, tenantless, schema-free networking runtime has been removed from @aphrodite/remote-guest; that package is now a small compatibility facade over the canonical shared contracts/client plus its pure legacy layout calculations. Its generated declaration comes from the real source graph, and no copied declaration or alternate signaling authority remains.

@oshun/live-media now owns strict remote-guest registration, provision, signaling, operation, evidence, and release contracts. Its clean @oshun/live-media/browser/remote-guest entry supplies a real one-host/one-guest RTCPeerConnection runtime and a restrained full-bleed studio surface. One-use invitation and signaling capabilities never enter URLs; the ticket travels in Sec-WebSocket-Protocol, the exact same-operation path is enforced, and all bounded signaling messages are role/schema/sequence checked. SDP and ICE remain transient. Readiness requires both browsers to submit positive reciprocal RTP evidence, with the guest outbound and host inbound video flow linked by a SHA-256 of the negotiated SSRC.

Aphrodite Broadcaster is the tenant-fixed HTTP and WebSocket composition. Host authority derives from the existing authenticated stream-owner boundary; the guest receives only a scoped Guest lease. Migration 00021_live_media_remote_guests and aphrodite.remote-guest.v1 provide one active operation per exact publisher grant/stream, forced RLS, digest-only secret custody, atomic one-use exchange/consumption, database-clock invitation and lifecycle expiry, semantic idempotency, reclaimable execution leases, restart replay, stale-writer fencing, and repeat-safe release. Durable rows exclude raw secrets, SDP, ICE, addresses, codec strings, device labels, and captured media.

Single-worker Chromium automation proves actual reciprocal audio/video between two independent browser contexts, the matching SSRC link, third-participant rejection, URL/DOM/durable credential non-disclosure, invite-fragment scrubbing, explicit mic/camera/leave controls, axe, keyboard behavior, mobile fit, reduced-motion elimination, proof visibility, and ordered teardown. The real PostgreSQL/MediaMTX gate proves migration, secret rotation and one-use replay denial, durable signal/secret absence, restart replay, RLS isolation, database-clock expiry, abandoned-lease recovery, stale-fence rejection, idempotent release, and cleanup. This is a bounded direct browser peer path; it does not claim SFU/MCU, TURN availability, multi-party rooms, screen share, end-to-end media encryption, native/mobile clients, or multi-node signaling.

Increment 7l implementation update (2026-07-20). The multi-source and performer-compositor rows above remain accurate pre-extraction audits, but their missing bounded production path no longer applies to the canonical substrate. @oshun/live-media/browser now renders one to four caller-owned live sources through Canvas 2D, mixes optional audio through Web Audio, captures the derived stream, and publishes it with the already-proven WHIP client. It owns strict single, grid, and two-source picture-in-picture layouts, bounded output profiles and evidence, an accessible full-stage surface, and teardown that does not stop caller-owned tracks. Aphrodite supplies only authenticated no-store control routes and the forced-RLS aphrodite.composition.v1 lifecycle. Success is joined to the exact succeeded browser/WebRTC publisher and independently observed positive MediaMTX ingress. Chromium and PostgreSQL/MediaMTX gates prove real changing pixels, audio, RTP, durable replay/recovery/fencing, tenant isolation, privacy, and cleanup. The legacy packages were not promoted as alternate authorities, and custom/transition/GPU/native/distributed composition remains outside this bounded claim.

Existing shared stacks and canonical home#

The remote branch already contains libs/shared/streaming, published internally as @oshun/streaming. It is a Kafka/schema-registry/exactly-once event-streaming library used for data/training pipelines, backpressure, temporal correlation, and latency tiers. Renaming its semantics or mixing media session authority into its topics would create an ambiguous package and risk unrelated consumers. It remains a dependency where Kafka event streaming is appropriate; it is not the live-media substrate named by RB.3.

The repo also has active libs/neith/stream-* packages. These are not merely names: stream-encoder runs FFmpeg reference encoders and probes hardware backends, while stream-transport has live WebRTC RTP/DataChannel, SRT, QUIC, multi-path QUIC, RIST, TLS fallback, and traversal code with loopback tests. Other Neith packages cover game-stream input, QoE, security, client, and GPU/ title session orchestration. They are valuable execution kernels, but their contracts are cloud-game/domain-shaped and do not provide the tenant-scoped RTMP/SRT-to-HLS/DASH live-broadcast control plane, durable viewer leases, chat, presence, or delivery grants required here.

Canonical decision: create the consolidation boundary at libs/shared/live-media, package @oshun/live-media. This avoids collision with Kafka @oshun/streaming and makes the media meaning explicit. It owns the tenant-neutral contracts and orchestration exactly once, and depends on—not copies—@oshun/cache, @oshun/storage, @oshun/event-bus, selected Neith encoder/transport kernels, and provider adapters. Aphrodite, Veritas, V3 Stage, and the Rail may only enter through tenant adapters. No implementation belongs under apps/v10 or libs/v10.

Target substrate boundary#

Every durable resource, cache key, event, credential, request context, metric, and log correlation must carry a non-optional tenantId plus the relevant substrate resource ID. A caller-supplied product user/creator/stream ID is an external reference, not global identity. The shared boundary should be divided into the following independently replaceable organs:

1. Contracts and authorization: verified principal/capability input, tenant/resource IDs, lifecycle state machine, typed errors, idempotency, versioned events, and cross-tenant denial before any provider call.
2. Ingest control and edge: short-lived hashed publisher grants, effective rotation/revocation, RTMP/SRT/WebRTC adapters, authoritative connect/ disconnect health, and reconciliation with the control plane.
3. Media pipeline and delivery: real encoder/transcoder execution, rendition/manifest packaging, media-object persistence, origin/CDN publication, signed playback grants, teardown, and honest readiness.
4. Viewer sessions and presence: entitlement-decision input, expiring playback grants, idempotent leased join/heartbeat/leave, multi-node atomic counts, reconnect semantics, and QoE reporting.
5. Live chat: tenant/resource rooms, schema-validated socket messages, durable history, moderation and entitlement ports, idempotency/rate limits, and distributed presence without Aphrodite product roles.
6. Hooks and telemetry: notification, audit, moderation, operational metric, and event ports. Provider failure policy is explicit; hooks cannot silently turn media or authorization failures into success.
7. Client and optional media adapters: browser/native publisher and player, remote guest/composition, DRM/encryption/watermarking, content analysis, and immersive descriptors/renderers. These extend the same grant/session model; they do not create alternate stacks.

The substrate deliberately does not own Aphrodite identity issuance, age or adult policy, payments/tips/shows, creator discovery, intimate devices, moderation case management, notification copy, dashboards, avatar/social presentation, or VR privacy preferences. Tenant adapters make those decisions and pass narrow authenticated results to the shared organs.

Incremental extraction and equivalence order#

1. Establish @oshun/live-media contracts, tenant/resource ID types, dependency direction checks, and negative cross-tenant contract tests.
2. Extract ingest credential/lifecycle behavior from the broadcaster and streaming services. Compose a real edge and Neith/FFmpeg execution adapter; prove key rotation/revocation and authoritative connect/disconnect.
3. Add rendition packaging, shared storage/CDN delivery, signed playback grants, and a deterministic local test stream. No simulated URL is accepted as evidence.
4. Move the viewer app to leased join/heartbeat/leave and reconcile counts through an atomic shared cache/durable ledger. Preserve Aphrodite policy in its adapter and test duplicate joins, crashes, expiry, and reconnect.
5. Move chat room/message/presence mechanics behind the same tenant/resource identity, retaining the existing deployable service as the Aphrodite adapter and behavior oracle.
6. Introduce tenant-tagged operational telemetry and notification/moderation hooks, migrating the warehouse schema before production reads or writes.
7. Add immersive, encryption/DRM, watermarking, content-analysis, recording, and client composition adapters only after the flat-video path passes.
8. Connect Veritas and V3 Stage as tenants #2/#3, then make the Rail's first-party-live class consume real HLS/DASH as tenant #4. Add the consolidation guard and run one supervised ingest-to-Rail E2E at a time.

For each move, the current Aphrodite route/store tests remain the product behavior oracle, while new substrate tests prove the generic contract. Required new evidence includes SQL identity mapping, tenant isolation, idempotency, multi-node/restart behavior, credential expiry/revocation, provider failures, real encoded bytes/manifests, decoded player media, QoE/lifecycle telemetry, and teardown. Hash-derived dashboards, memory-only success, generated URLs, timer-completed state, or helper argument arrays are explicitly insufficient.

Extraction progress (through 2026-07-22)#

• Increment 1 is implemented at @oshun/live-media: tenant/resource contracts, capability authorization, lifecycle semantics, dependency-direction checks, publisher-grant service/store ports, and negative cross-tenant tests.
• The credential half of increment 2 is implemented. Aphrodite has a durable RLS-protected, digest-only grant adapter and a tenant-fixed control facade; broadcaster and streaming stores issue, rotate, revoke, and authenticate the same shared grants while preserving their HTTP response shapes. The legacy streams.stream_key column contains only a constrained grant-managed:<stream UUID> compatibility sentinel.
• MediaMTX external auth now binds a grant to the exact stream path, and connect/disconnect callbacks require a separately configured shared secret before changing lifecycle state. Route-equivalence, ownership-isolation, SQL-boundary, migration, and real PostgreSQL checks cover this increment.
• The publisher-edge half of increment 2 is implemented. The shared substrate now owns tenant-scoped publisher observations, exact connection identity, idempotent refresh/replacement/disconnect semantics, provider-error types, and authoritative reconciliation. Aphrodite persists the current publisher in an RLS-protected table and rejects stale disconnects after replacement.
• The MediaMTX provider consumes the paginated v3 Control API, supports current and legacy readiness/byte fields, and maps RTMP, SRT, WebRTC, and RTSP publisher sources without admitting unmanaged paths. The streaming service reconciles immediately and periodically without overlapping polls; failed snapshots are retried and never treated as empty state.
• A gated local E2E runs a digest-pinned MediaMTX 1.19.2 container and a real FFmpeg SRT publisher. It proves forged-grant rejection, exact-stream auth, nonzero encoded-byte observation, HLS generation and decoded H.264 probing, durable control-plane restart behavior, and missed-disconnect reconciliation.
• The encoder half of increment 2 is implemented without adding an app-owned media stack. @oshun/live-media owns a tenant/resource-scoped execution contract that authorizes live-media:stream:operate before invoking a provider. The server-only Neith provider accepts only credential-free allow-listed inputs and exact <root>/<tenant>/<stream>/<execution>.ts outputs, rejects canonical path escapes, symlink aliases, and pre-existing output, atomically reserves the execution path, removes partial media on failure/cancellation, spawns a shell-free runner argument vector, bounds process diagnostics, and exposes idempotent TERM/KILL cancellation. Success is accepted only after the output is a nonempty file and ffprobe measures the requested H.264/AAC codecs and dimensions.
• neith-stream-transcoder is a compiled Rust runner in the existing Neith encoder crate. Its validated plan executes FFmpeg with bounded dimensions, frame rate, bitrates, and duration; low-latency H.264 High/AAC MPEG-TS; deterministic two-second GOP/CFR settings; and TCP media transport for RTSP. On Unix it replaces itself with FFmpeg so worker signals govern the real encoder rather than an orphan wrapper. Aphrodite supplies only a tenant-fixed internal worker facade.
• The same gated E2E now reads the live MediaMTX stream over RTSP through that compiled Neith runner, produces a 640x360 rendition, and independently proves nonzero duration/bytes plus decoded H.264/AAC output. Contract/provider tests cover cross-tenant denial before execution, unsafe protocol and path denial, process failure, mismatched output, and idempotent cancellation.
• Increment 2 is complete. Its real execution adapter feeds the durable job and publication composition completed in increment 3; no route fabricates worker or media state.
• Increment 3's publication/delivery foundation is implemented in the same shared organ. Tenant-authorized publication contracts reserve immutable object prefixes and persist exact source measurements, rendition identity, lifecycle revision, failure state, and the verified object ledger. Aphrodite's PostgreSQL adapter uses a per-publication advisory lock and forced RLS for publishing/ready/failed/revoked transitions; its facade fixes the aphrodite substrate tenant and never accepts a caller-selected namespace.
• The server implementation packages real Neith output into HLS MPEG-TS and DASH fragmented MP4, probes H.264/AAC and dimensions through both manifests, publishes segments before manifests to create-only local or official AWS S3/MinIO storage, and verifies stored checksums. HMAC-SHA256 bearer grants bind one entitlement decision to one publication prefix and exact object ledger; every origin authorization re-reads durable ready state, making revocation immediate across service restarts.
• Durable transcode/publication orchestration is now part of the same shared organ. MediaPipelineJob has bounded validated requests, idempotent enqueue, cancellation, retry/backoff, expiring database-clock leases, renewal, and fencing. Its Aphrodite SQL store uses FOR UPDATE SKIP LOCKED, forced RLS, tenant/stream-scoped identities, and a composite resource foreign key from a successful job to its immutable publication. The shared worker and attempt executor connect the real Neith transcode, HLS/DASH packager, object publisher, and publication state machine without app-owned encoding logic.
• Aphrodite streaming now composes that store, control facade, and supervised scheduler only under explicit complete production configuration. Exact INTERNAL_API_KEY authentication protects real enqueue/list/read/cancel routes; disabled or invalid runtime configuration returns an explicit 503. Restart, expired-lease recovery, retry, cancellation, concurrent claim, and stale-worker fencing are covered at the shared, SQL-adapter, route, and real PostgreSQL boundaries.
• Aphrodite viewer now maps the authenticated JWT sub through viewers.user_id, evaluates account, age, sensual-tier, block, subscription/private-show, stream-state, and ready-publication policy in a read-only repeatable-read SQL transaction, then issues a short-lived grant. The route accepts no caller-selected tenant, publication, object prefix, entitlement decision, or key. Auth access tokens carry and verify fixed issuer/audience claims; the remaining process-local JTI revocation limitation is documented rather than presented as distributed security.
• Streaming exposes a production authorization-subrequest endpoint for an external private-bucket origin proxy. It verifies the exact requested object against the signed ledger and re-reads durable publication and viewer-lease state on every request, so revocation, expiry, reconnect fencing, and leave remain immediate across process restarts. It does not pretend to serve S3/CDN bytes; deployment must keep the bucket private and enforce the returned authorization decision at the proxy.
• Increment 4's viewer-session/presence organ is implemented in the shared package. Its tenant-scoped service owns entitlement-bounded idempotent join, rotating digest-only lease credentials, heartbeat, explicit leave, crash expiry, reconnect fencing, exact active-session/unique-viewer presence, and immutable bounded QoE samples. The playback-grant format now binds the viewer session and refuses both issuance and origin authorization without an active lease.
• Aphrodite's forced-RLS PostgreSQL adapter uses database time, per-resource advisory serialization, exact token-digest checks, durable lifecycle/QoE ledgers, lazy expiry, and SQL-derived multi-node counts. Viewer identity and entitlement stay in the existing policy adapter; the Viewer app is a thin composition over canonical leased playback, heartbeat, leave, and presence routes. Its legacy direct playback-URL/counter mutation routes return 410 and no longer form a competing authority.
• The supervised local E2E runs digest-pinned MediaMTX 1.19.2 and PostgreSQL 16 containers plus real FFmpeg/ffprobe. It applies canonical migrations 00005–00010 in sequence against the existing text stream IDs; proves forged publisher denial, exact-stream auth, live encoded bytes, durable job idempotency, concurrent claiming, process reconstruction, expired-lease recovery, stale-worker fencing, retry-safe publication, forced-RLS isolation, SQL age-policy denial/allowance, idempotent session refresh, two-store presence aggregation, exact QoE persistence, lifecycle ordering, crash expiry, reconnect token fencing, and leave; then it decodes protected H.264/AAC through both HLS and DASH before proving object denial after viewer-session invalidation and durable publication revocation, followed by publisher teardown. MediaMTX is configured entirely through environment variables from an empty working directory, so this gate does not consume a host configuration-file watcher.
• Increment 4's release evidence includes green shared (106), Aphrodite adapter (59), database/migration (207), Viewer (177), and Streaming (73) test suites; direct library/app/spec typechecks; targeted lint; both application builds; Prisma schema validation; and the separately enabled real edge E2E (1). The known Vite warnings are missing source maps for pre-existing generated shared database JavaScript and do not represent test failures.
• Increment 4 is complete at the code and local release-gate boundary.
• Increment 5's live-chat organ is implemented in @oshun/live-media. The tenant/resource-scoped contract owns durable memberships, leased presence, bounded history, idempotent sends, rate limits, room clears, and ordered join/leave/message/delete/clear events. Client messages are text-only; validated attributed tips and system notices are server-only capabilities.
• Aphrodite's forced-RLS PostgreSQL adapter binds every join, heartbeat, send, and history read to the exact allowed entitlement, subject, viewer session, resource, and database-clock validity window. Composite membership/sender foreign keys and message-shape checks independently reject forged senders, client-shaped tips, invalid amounts, and attributed text. Per-resource advisory serialization makes message sequence allocation, clears, and event commits deterministic across nodes.
• The existing Chat deployable remains the thin Aphrodite tenant composition. REST and Socket.IO share canonical UUID identity, entitlement policy, viewer-session admission, durable history, sanctions, content filters, and moderation revocation. Socket membership is joined only after the durable lease succeeds; cross-node PostgreSQL polling fans committed events out in order, while expiry, explicit leave, bans, and entitlement revocation evict the same canonical identity.
• The digest-pinned PostgreSQL 16 gate applies migrations through 00011, exercises forced-RLS tenant isolation, restart/reconstruction, two-store fanout and presence, reconnect fencing, policy and moderation denial, invalid tip rejection, compatibility history reads, and externally held advisory-lock contention. No message or event becomes visible before commit, and committed event sequence matches serialized message order.
• Increment 5's release evidence includes green shared live-media (126), Aphrodite adapter (76), database/migration (210), and Chat (57) test suites, plus the separately enabled real PostgreSQL E2E (1). Strict library, spec, and application typechecks; the Chat typecheck ratchet; targeted lint; Prisma validation; direct affected Nx builds; the Chat production build; and diff validation pass. The only lint diagnostics are eight existing Chat console warnings; test source-map warnings refer to pre-existing generated shared database JavaScript. A dependency-inclusive adapter build additionally reaches an unrelated pre-existing TypeScript 6 baseUrl deprecation failure in @aphrodite/core; the adapter's direct build and strict typecheck pass. The affected pre-commit typecheck likewise passes every increment-5 owner but is blocked by Aphrodite Payment's pre-existing ratchet backlog, including its own root-directory and webhook/store errors.
• Increment 5 is complete at the code and local release-gate boundary. The parent RB.3 extraction item remains open for hooks/telemetry, increments 7–8, Veritas/V3/Rail tenant equivalence, the consolidation guard, and the final supervised ingest-to-Rail E2E.
• Increment 6's operational-telemetry organ is implemented in @oshun/live-media. Its strict versioned envelope requires the exact tenant and stream resource, bounded attributes and finite measurements, event source, occurrence and correlation identity, and an idempotency key. Separate capabilities authorize resource-exact write, read, and hook dispatch. The substrate taxonomy covers publisher, stream, pipeline, publication, viewer, QoE, chat, and moderation lifecycle facts; it does not bless Aphrodite's unauthenticated, tenantless legacy analytics_events taxonomy as shared telemetry or move product/revenue reporting into the substrate.
• The new 00012_live_media_operational_telemetry migration precedes production composition and creates a dedicated event ledger plus atomic hook outbox. Composite tenant identities, resource/idempotency uniqueness, bounded vocabulary and payload checks, forced RLS, claim and expired-lease indexes, and durable attempt/availability/lease/provider state make the database—not a process map—the authority. Aphrodite's tenant-fixed SQL adapter uses an advisory idempotency lock, database time, FOR UPDATE SKIP LOCKED, proposed lease tokens, and current-lease fencing. Provider errors retry with bounded backoff and become explicit dead letters; an unacknowledged final attempt also dead-letters when its lease expires instead of looping or disappearing.
• Notification, moderation, and audit are reusable hook kinds. The shared worker dispatches only a matching registered hook and cannot change media, authorization, or telemetry success. Aphrodite supplies thin notification and moderation adapters: stream lifecycle becomes a tenant product notification seam without generic copy/audience policy, while moderation denial becomes a tenant case seam without message content. Provider references and failures are preserved in the outbox. Creator targeting, notification copy, audience resolution, sanctions, and case management remain Aphrodite-owned.
• Aphrodite's publisher edge, Viewer runtime, and canonical Chat runtime now record production-path lifecycle events through the same tenant-fixed SQL writer. Refresh and duplicate paths replay stable semantic envelopes into the idempotent ledger without inflating counts; publisher connection/revision, viewer session/reconnect, QoE sample, stable chat membership/message, and committed clear-event identities provide exact idempotency. Durable Chat polling reprojects committed events after restart to repair any post-commit fanout gap. Chat projections contain only bounded identity/status/count metadata—never message bodies—and product moderation records durable/filter/ duplicate denial reasons without copying rejected content.
• The digest-pinned PostgreSQL 16 Chat gate applies migrations through 00012 before starting the production composition. It proves durable chat and moderation telemetry, pending moderation outbox state, absence of filtered content, process reconstruction, two concurrent workers claiming one audit delivery exactly once, real provider failure followed by retry and terminal dead letter, persisted attempts/error detail, and forced-RLS denial to another tenant. The deterministic memory oracle additionally matches SQL behavior for an expired final-attempt lease.
• Increment 6's release evidence includes green shared live-media (141), Aphrodite adapter (91), database/migration (213), Chat (59), Viewer (177), and Streaming (73) test suites, plus the separately enabled real PostgreSQL E2E (1). Strict library/spec/application typechecks, Chat's zero-backlog ratchet, targeted production and test lint, Prisma validation, isolated shared, adapter, and database builds, all three affected application builds, and diff validation pass. The known Vite diagnostics remain missing source maps for pre-existing generated shared-database JavaScript. The dependency-inclusive adapter build still reaches the unrelated @aphrodite/core TypeScript 6 baseUrl deprecation; the adapter's own build and strict typecheck pass. The repository pre-commit typecheck also passes every affected project before stopping on ten unrelated, pre-existing apps/aphrodite/payment ratchet errors; the commit therefore uses the documented typecheck bypass after the direct strict affected checks above.
• Increment 6 is complete at the code and local release-gate boundary. The parent RB.3 extraction item remains open for optional adapters in increment 7, Veritas/V3/Rail tenant composition in increment 8, the consolidation guard, tenant equivalence, and the final supervised ingest-to-Rail E2E.
• Increment 7a establishes the optional-media/client extension boundary without registering any simulated legacy package as a production provider. The shared contract enumerates immersive, segment-encryption, DRM, watermark, content-analysis, recording, publisher-client, player-client, remote-guest, and composition adapters. Every operation has an exact tenant/stream resource, semantic idempotency key, bounded adapter identity, and the relevant publication, viewer-session, playback-grant, publisher-grant, or authoritative publisher-connection references. Raw keys, ingest/playback secrets, DRM challenges, media URLs, and client/device fingerprints are not admitted.
• The optional-adapter service denies tenant or capability mismatches before binding verification or provider access. A mandatory authority port must prove exactly the active bindings for that operation; unrelated or incomplete evidence fails closed. Readiness must be fresh, internally coherent, and declare every kind-specific media source, object store, key-custody, vendor/executable, client-runtime, or edge-observation dependency. Provider failure remains failure rather than a local success state.
• Successful adapters must return the authorized operation identity, kind-specific conformance proofs, and the expected measured artifact. Server artifacts require a nonzero byte count and SHA-256 digest; immersive/player paths require decoded-media evidence, publisher/guest/composition paths require real edge or peer/render evidence, DRM requires vendor-license plus key-custody proof, and teardown is an explicit resource-matched operation. Strict immersive descriptors validate projection, stereo layout, geometry, codec, bounded runtime capability negotiation, and mono/stereo/binaural/ACN ambisonic channel invariants without accepting headset serial, location, gaze, or other product privacy data.
• Increment 7a's shared library/spec typechecks, focused lint, formatting, and all 151 shared live-media tests pass. This is the reusable contract foundation, not completion of increment 7: real durable providers, pipeline/client composition, media and vendor conformance fixtures, browser/native automation, provider-failure recovery, and teardown evidence remain actionable. In particular, the audited timer/generated cloud recorder, non-conformant DRM license facades, process-keyed encryption/watermark services, and no-op mobile publisher/player managers remain excluded.
• Increment 7b adds the first real optional provider without changing that exclusion policy: aphrodite.content-analysis.v1 is a thin Aphrodite tenant composition over the shared optional-adapter boundary. A trusted internal control fixes tenant, adapter, capability, and advisory policy; its authority verifier accepts only the exact checksum of a ready publication's MPEG-TS or fragmented-MP4 video object. Callers cannot upload a frame, choose a provider credential, supply a media URL, select another tenant, or request automatic policy action.
• The provider reads the bounded published object through a checksum-verifying local/S3 port, extracts and measures a JPEG using the real FFmpeg executable, and calls the audited OpenAI-compatible StreamAnalyzer path. HTTPS is mandatory outside loopback. Both auto-age-gating and automatic policy action are forced off. The immutable JSON artifact keeps only bounded advisory category, age, policy, object, face-count, and text-region-count evidence; it excludes raw samples, OCR bodies, biometric identifiers, and the legacy provider's automatic-action recommendation.
• Migration 00013_live_media_content_analysis creates a publication-FK-bound, forced-RLS operation ledger with semantic idempotency, bounded attempts, create-only result evidence, and fenced leases. PostgreSQL's clock—not request time—owns claim, renewal, expiry, and settlement. A heartbeat renews slow FFmpeg/vendor work; renewal loss prevents both success and stale failure settlement. Exact succeeded retries replay the durable result after process reconstruction without another sample or vendor call.
• Aphrodite Streaming composes the provider only when every S3, FFmpeg, vendor, policy, worker, lease, and size setting is valid. Its probe, execute, and one-shot teardown routes require the existing internal API key plus a bounded service identity. Unit/integration coverage exercises strict binding, checksum and media-type denial, absolute readiness freshness, privacy non-disclosure, retryable provider failure, lease renewal/loss, configuration, route authorization, teardown, real FFmpeg sampling, and a real loopback OpenAI-compatible HTTP exchange.
• The digest-pinned supervised MediaMTX/PostgreSQL gate applies migration 00013 atop the real publication pipeline, samples an actual published transport segment, verifies its immutable evidence, reconstructs the database and provider, proves exact no-reexecution replay, serializes two concurrent claims, recovers the expired lease, fences the stale writer, denies a second tenant under RLS, and tears down cleanly. Increment 7b is therefore complete at the code and local release-gate boundary. At this point increment 7 still requires the recording and remaining immersive, encryption/DRM, watermarking, publisher/player, remote-guest, and composition providers plus their applicable browser/native automation.
• Increment 7c adds aphrodite.recording.v1 as a second real optional provider. A trusted internal control fixes tenant, adapter, capability, worker, object namespace, and retention-policy custody while accepting only a bounded asynchronous request. The exact publisher connection must agree between the forced-RLS edge-session ledger and a fresh MediaMTX Control API observation; the RTSP(S) input is derived from operator configuration, never supplied by a caller. Interactive stop, DVR, segment tracking, export, and cleanup jobs remain explicit 501 gaps rather than simulated controls.
• The executor runs real shell-free FFmpeg stream-copy capture with a hard duration/deadline, abort-driven TERM/KILL shutdown, canonical private attempt directories, bounded diagnostics, and cleanup before terminal success. FFprobe must measure the requested MP4 or Matroska container, a decodable video stream, dimensions, duration, and optional audio. The output is hashed through an open descriptor, staged durably, uploaded create-only through the shared streaming-safe local/S3 object store, re-read by exact checksum/length, and returned with the shared recorded-media and object-persistence proofs plus a byte-bearing recording artifact.
• Migration 00014_live_media_recording supplies a forced-RLS, stream-FK-bound queue with semantic idempotency, unique recording identity, bounded attempts/backoff, database-clock leases, heartbeat renewal, lease-token fencing, exact terminal evidence, and a staged artifact descriptor. A restarted worker settles an already-uploaded object without recapturing the publisher; an expired final-attempt lease becomes an explicit terminal failure rather than a stranded processing row. Provider, object, cleanup, or shutdown failures remain retryable only while the current lease can record that outcome.
• Streaming composes the recording control and supervised worker only when the base durable pipeline/S3 custody plus MediaMTX control/RTSP, absolute private workspace, retention, FFmpeg/FFprobe, lease, retry, and worker settings are complete. Auth-first POST enqueue returns 202; exact operation status and readiness reads require the deployment internal key and a bounded service identity. Unit, SQL, route, configuration, scheduler, and executor coverage proves binding disagreement/freshness denial, strict request shape, restart settlement, retry/backoff, final-attempt recovery, stale-writer fencing, result-to-staged-object equality, shutdown cancellation, and tenant denial.
• The digest-pinned supervised MediaMTX/PostgreSQL gate applies migration 00014, reconciles the real SRT publisher into SQL, captures its RTSP stream with FFmpeg, independently FFprobes the immutable MP4 as H.264/AAC, verifies exact object checksum/length, reconstructs the database/source/provider, proves result replay without a second FFmpeg call, serializes concurrent claims, recovers an expired lease, fences the stale writer, denies another tenant under RLS, and tears down the publisher and both containers. Increment 7c's release evidence includes green shared live-media (156), Aphrodite adapter (123), database/migration (219), and Streaming (87, with the separately enabled real edge E2E also green) suites; the explicit Streaming integration target adds 18 green tests. Strict source/spec typechecks, affected lint, Prisma validation, isolated and dependency-inclusive builds, formatting, and diff validation pass. The dependency graph now emits declarations for stream-content-analysis under TypeScript 6, so the previously blocked @aphrodite/core → content-analysis → adapter → Streaming Nx build chain also passes; the prerequisite core (421) and content-analysis (140) suites remain green. The affected pre-commit typecheck passes every increment-7c owner before stopping on the same ten unrelated, pre-existing Aphrodite Payment ratchet errors recorded above; the commit therefore uses the hook's documented typecheck bypass after the direct strict checks. Increment 7c is complete at the code and local release-gate boundary. Increment 7 remains open for immersive, encryption/DRM, watermarking, publisher/player, remote-guest, and composition providers plus applicable browser/native automation.
• Increment 7d adds aphrodite.segment-encryption.v1 as the first real content-protection provider. It deliberately implements only standards-based HLS AES-128 segment protection: CENC and CBCS are rejected before binding or queue mutation, and no vendor DRM/CDM license compatibility is claimed. A tenant-fixed policy selects one public key reference/version, while callers may name only an exact ready publication and semantic operation identity.
• The provider reads the publication ledger's complete authoritative HLS graph, accepts canonical VOD manifests and complete MPEG-TS segments only, rejects traversal/remote/range/map/i-frame/encrypted/orphan/duplicate inputs, and enforces per-object and total byte bounds. It encrypts each segment with AES-128-CBC plus PKCS#7 padding and the HLS media-sequence IV, re-reads and independently decrypts every create-only object back to the exact source bytes, writes media manifests with internal key URIs, then writes the master and a key-free checksummed descriptor last. A retry accepts an existing object only when checksum, length, and media type agree exactly.
• Key custody composes the audited Neith PKCS#11 KMS backend with an operator-provisioned, nonextractable RSA-3072 KEK. Each operation creates one random 256-bit data key, derives its 128-bit content key under a domain-separated HMAC bound to the complete request context, wraps only the data key, and zeroes plaintext buffers. Durable custody includes public key policy, HSM object identity, wrapped bytes, context and recovery-verification digests, output namespace, and internal key URI; neither PostgreSQL nor the publication descriptor admits plaintext/content/key-byte fields. Recovery rejects wrong policy/context and tampered wrapped data before returning exactly 16 bytes.
• Migration 00015_live_media_segment_encryption supplies the composite publication FK, forced RLS, semantic idempotency, bounded custody/artifact JSON, database-clock backoff, expiring renewable leases, lease-token fencing, staged custody/publication recovery, and exact terminal evidence. The protected-publication descriptor is staged durably before its own create-only object is committed, so a restarted provider settles the same output without minting another data key or changing ciphertext. Expired attempts are recoverable and stale workers cannot renew, stage, succeed, or release them.
• Aphrodite Streaming composes the provider and supervised worker only when the base publication/object store, worker, fixed key policy, internal key base URI, PKCS#11 module/token/PIN/tooling, HSM KEK, lease, retry, object-count, and byte bounds are complete. Auth-first internal routes expose readiness, 202 enqueue, exact durable status, and succeeded-only raw key delivery. The key response is exactly 16 bytes with no-store, zero-age, Pragma: no-cache, octet-stream, fixed content length, and nosniff; the recovered control buffer is zeroed after the response owns a copy.
• Unit, SQL, migration, route, configuration, and provider coverage proves policy and authority denial, authoritative graph validation, independent ciphertext round-trip, key-free descriptors, wrapped-key tamper detection, restart replay, backoff, expired-lease recovery, stale-token fencing, staged result equality, concurrent claim serialization, and tenant denial. The supervised real gate applies migration 00015 to PostgreSQL, provisions a nonextractable RSA KEK in SoftHSM, protects the FFmpeg-produced HLS, confirms no raw key material in SQL, rejects unauthenticated key delivery, and has an independent authenticated FFprobe client decode H.264/AAC through the protected manifest and key route. It then reconstructs the database, PKCS#11 custody, store, and provider for exact terminal replay; recovers an expired lease; fences the stale token; and proves forced-RLS denial to another tenant.
• Increment 7d's release evidence includes green Aphrodite adapter (137), database/migration (222), Streaming (93, plus the separately enabled real edge E2E), Neith vault-engine/SoftHSM (40), and shared optional-media contract (11) suites. Strict source/spec/application typechecks, affected lint, Prisma validation, dependency-inclusive adapter/database builds, the Streaming production build, formatting, and diff validation pass. Increment 7d is complete at the code and local release-gate boundary. Increment 7 remains open for CENC/CBCS and vendor DRM, immersive, watermarking, publisher/player, remote-guest, composition, protected-object/key cleanup, viewer integration, and applicable browser/native conformance automation.
• Increment 7e adds aphrodite.watermark.v1 as a real optional-media provider, while deliberately limiting its claim to a visible keyed marker. The trusted control fixes the tenant, adapter, aphrodite.visible-grid.v1 profile, public key reference/version, output namespace, and worker. Callers name only an exact operation/idempotency identity, ready publication, published video/mp2t source key/digest, and optional viewer session. The payload reference is derived from the publication or viewer session and cannot be supplied independently.
• The binding and execution paths both require the exact ready publication and source object. A non-null viewer session must still be active, entitlement-valid, and tenant/resource exact according to database time. The source must be real H.264/AAC MPEG-TS within configured byte limits. Remote, caller-selected, mismatched, unready, released, or differently encoded inputs fail before they can become successful evidence.
• The shell-free FFmpeg executor encodes an opaque keyed 8x8 black/white grid into the top-right picture region, preserving H.264 video and AAC audio in an MPEG-TS output. Verification decodes the actual output, samples all 64 cell centers from exact pixels, recomputes the expected bits, and measures luma PSNR against the decoded source outside the complete grid bounding box. The output is accepted only when extraction and the operator PSNR floor pass. Evidence names this visible-grid behavior and expressly makes no invisible or forensic-robustness claim.
• Custody reuses the generic PKCS#11 media-key boundary introduced by segment encryption. Each operation creates a random 256-bit data key, wraps it under an operator-provisioned nonextractable RSA-3072 KEK, and derives the 64-bit grid token by domain-separated HMAC over the complete request context. The durable record admits only wrapped bytes, fixed policy/HSM identity, and context/data-key/token verification digests. Plaintext data-key and token buffers are zeroed and never enter PostgreSQL, output media, or evidence JSON.
• Migration 00016_live_media_watermark adds a composite publication foreign key, optional viewer-session foreign key, forced tenant RLS, semantic idempotency, database-clock backoff, renewable expiring leases, lease-token fencing, bounded staged custody/artifact JSON, exact terminal replay, and a durable release timestamp. The provider writes create-only media before its checksummed descriptor; a restart verifies exact existing bytes and settles staged state without another encode. Teardown removes both fixed objects before release, is repeat-safe, and prevents the same operation identity from recreating deleted media.
• Auth-first internal Streaming routes expose dependency readiness, 202 enqueue, durable status, and destructive release only when the base pipeline, fixed policy, FFmpeg/FFprobe, object store, queue, and complete PKCS#11/HSM configuration are present. Unit, SQL, migration, route, runtime, and provider coverage proves fixed policy/payload derivation, viewer denial, exact source binding, secret non-disclosure, pixel extraction and PSNR enforcement, create-only crash recovery without re-encoding, database-clock backoff, expired-lease recovery, stale-token fencing, tenant isolation, and release fencing. The separately enabled real edge gate applies migration 00016 to PostgreSQL, reuses a real nonextractable SoftHSM RSA KEK, transforms an actual FFmpeg H.264/AAC segment, inspects durable wrapped-only custody, reconstructs the store/provider for exact replay, recovers and fences an abandoned lease, proves forced-RLS denial, and deletes both artifacts before durable release.
• The production dependency remains narrow: neith-vault-engine advertises an audited capability:kms boundary and a build/type gate, the Aphrodite adapter owns the provider-neutral PKCS#11 factory, and the Streaming app imports only that custody facade. Increment 7e's release evidence includes green Neith vault-engine (40), Aphrodite adapter (151), database/migration (225), and Streaming (98 plus the separately enabled real edge E2E) suites. Strict source/spec/application typechecks, targeted module-boundary lint, Prisma validation, the dependency-inclusive adapter/database build, the Streaming production build, frozen lockfile validation, formatting, and diff validation pass.
• Increment 7e is complete at the code and local release-gate boundary. Increment 7 remains open for CENC/CBCS and vendor DRM, immersive, publisher/player, remote-guest, composition, segment-encryption viewer and cleanup wiring, and applicable browser/native conformance automation.
• Increment 7f adds aphrodite.player-client.v1 as the first real client-side optional provider and deliberately limits the claim to authenticated browser HLS. Protected playback reserves one credential-free operation for the exact ready publication, active viewer session, issued playback grant, client instance, and protocol. DASH registration returns no player operation and the provider rejects non-HLS execution; native and immersive clients remain open.
• Migration 00017_live_media_player_client adds a forced-RLS operation ledger with composite publication, viewer-session, and QoE-event foreign keys, semantic idempotency, one active operation per viewer session, database-clock lifecycle expiry, expiring reclaimable execution leases, immutable first evidence, and repeat-safe durable release. Refresh releases the superseded grant operation. A succeeded result requires a previously committed playing QoE row whose playbackGrantId, session, resource, protocol, and positive decoded-frame count all match. Evidence and result constraints reject bearer, credential, lease-token, and token fields.
• @oshun/live-media/browser now exports the same-origin Aphrodite join, heartbeat, and leave client plus an HLS.js/MSE player. It rejects cacheable control responses and cross-origin APIs, never sends the media Bearer to the application API, opens only media URLs under the grant's exact origin and publication prefix, and has no unsafe native-HLS fallback. Readiness requires measured video dimensions, a positive decoded-frame count, durable QoE acceptance, and the exact first succeeded player-operation proof. Later heartbeats retain that immutable proof; fatal loader, authorization, decode, or heartbeat failure destroys media, clears the credential, and releases the viewer session.
• The player surface follows the mandatory frontend workflow: decoded media is the dominant near-black stage, status and controls are compact, focus and accessible names are explicit, controls recede during playback, mobile layout remains usable, reduced motion removes transitions, and authorization or publication-boundary failure is never rendered as success. The Playwright gate generates H.264/AAC HLS with real FFmpeg and Chromium, then proves decode, repeated heartbeats, exact-prefix authorization, cross-publication blocking before bearer disclosure, revocation, durable release, axe conformance, responsive layout, and reduced motion.
• The digest-pinned MediaMTX/PostgreSQL gate applies migration 00017, creates and refreshes real protected viewer grants, proves superseded-operation release, commits exact decoded QoE into a succeeded operation after process reconstruction, inspects the conformance proofs, confirms the Bearer is absent from SQL, denies a second tenant under forced RLS, reconnects, and durably releases on leave. Increment 7f's release evidence includes green shared live-media (174), Aphrodite adapter (162), database/migration (228), Viewer (182), and Streaming (98 plus the separately enabled real edge E2E) suites; four FFmpeg/Chromium Playwright scenarios; strict source/spec/application typechecks; all five affected lint targets; five scoped production builds; frozen lockfile, formatting, and diff validation.
• Increment 7f is complete at the code and local release-gate boundary. At that boundary, parent increment 7 and RB.3 remained open for DASH/native players, immersive rendering, CENC/CBCS and vendor DRM, publisher-client, remote-guest, composition, protected-media viewer/cleanup wiring, remaining client conformance/recovery automation, tenant equivalence, the consolidation guard, and the complete ingest-to-Rail flow.
• Increment 7g extends the same real aphrodite.player-client.v1 provider to authenticated browser DASH without adding a second player stack. The control registers only browser device sessions, binds persisted QoE to the exact HLS or DASH protocol, and emits aphrodite.browser-hls.v1 or aphrodite.browser-dash.v1 runtime proof accordingly. The SQL reservation and execution binding independently require device_type = 'browser'; the real PostgreSQL gate rejects a TV session even when its publication, session, client instance, and protocol otherwise match.
• @oshun/live-media/browser now selects HLS.js or dash.js from the protocol returned by the authenticated join. Both clients attach the Bearer only after the exact publication-prefix check. DASH uses asynchronous request and response interceptors, omits ambient cookies, permits CORS to the protected media origin, maps HTTP 401/403 before dash.js reduces the response to a generic download error, reports representation/throughput/buffer/live-latency QoE, and destroys the runtime plus credential on every terminal path. The protocol-neutral surface retains the same accessible near-black stage; the HLS class and mount names remain compatibility aliases, not a duplicate UI.
• The FFmpeg/Chromium gate now generates real H.264/AAC MPEG-TS HLS and fragmented-MP4 DASH and runs eight one-worker cases: decode, repeated durable heartbeat proof, exact-prefix credential containment, malicious cross-publication blocking before disclosure, authorization loss, release, axe conformance, mobile layout, and reduced motion for both protocols. The supervised MediaMTX/PostgreSQL gate commits exact DASH QoE and the DASH runtime proof after reconstruction, denies non-browser registration and another tenant, proves secret non-disclosure, independently decodes protected HLS and DASH, and exercises DASH expiry, reconnect, tamper, leave, and publication revocation.
• Increment 7g's release evidence includes green shared live-media (179), Aphrodite adapter (164), Viewer (184), and Streaming (98 plus the separately enabled real edge E2E) suites; eight FFmpeg/Chromium Playwright scenarios; strict source, spec, and application typechecks; all four affected lint scopes; four scoped production builds and their declared dependencies; and filtered frozen-lockfile, formatting, and diff validation.
• Increment 7g is complete at the code and local release-gate boundary. The parent increment 7 and RB.3 checkboxes remain open for native players, immersive rendering, CENC/CBCS and vendor DRM, publisher-client, remote-guest, composition, protected-media viewer/cleanup wiring, remaining client conformance/recovery automation, tenant equivalence, the consolidation guard, and the complete ingest-to-Rail flow.
• Increment 7h adds the real aphrodite.publisher-client.v1 provider and limits its runtime claim to authenticated browser WHIP. Broadcaster provisioning rotates one short-lived publisher grant and reserves the grant ID as the exact operation ID for one tenant stream, browser client instance, and WebRTC protocol. The application control API and media endpoint remain separate: only the exact secure MediaMTX /whip endpoint receives the memory-only Bearer; plain HTTP is admitted solely for loopback testing.
• MediaMTX external auth treats a WebRTC OPTIONS request as a credentialed capability probe but does not invent a source identity. The subsequent WHIP POST binds that same active grant to MediaMTX's exact source connection ID and edge. Browser heartbeats persist only monotonic outbound bytes, packets, and encoded frames; success requires positive inbound bytes independently observed on that same connected edge row. The provider emits separate client-runtime and edge-observation proofs plus a client-session artifact without receiving or persisting the Bearer, SDP, ICE addresses, or device details.
• Migration 00018_live_media_publisher_client adds a forced-RLS operation ledger with an exact composite grant/resource foreign key, semantic idempotency, one active publisher operation per stream, database-clock expiry, expiring reclaimable execution leases, immutable success evidence, and repeat-safe release. Unknown-operation deletion is checked before grant revocation, and storage conditionally revokes only the operation's exact grant ID. A valid-but-unrelated or superseded operation therefore cannot invalidate a newer live grant. Release durably fences the requested operation.
• @oshun/live-media/browser negotiates send-only audio/video through WHIP, validates the returned session location inside the same endpoint boundary, samples real outbound WebRTC statistics, rejects counter regression, and reports publishing only after the exact durable edge/client proof. Stop and every failed-start path attempt WHIP DELETE, peer/media shutdown, and durable release; combined cleanup failures remain explicit TEARDOWN_FAILED errors.
• Unit, SQL migration, route, provider, and store coverage proves exact binding, monotonic evidence, connection replacement rejection, no edge-free success, restart replay, unknown-operation safety, lease fencing, tenant denial, and teardown aggregation. The digest-pinned MediaMTX/PostgreSQL gate applies migration 00018 around the existing real SRT publisher, reconciles positive edge ingress, reconstructs the provider for exact replay, inspects secret-free SQL, denies another tenant, and releases all resources. The separate real MediaMTX/Chromium gate distinguishes the WebRTC OPTIONS probe from the WHIP source ID, publishes real encoded video, validates Bearer containment and durable readiness, and exercises authorization and failed-start cleanup alongside the existing FFmpeg-backed HLS/DASH player scenarios.
• Increment 7h's release evidence includes green shared live-media, Aphrodite adapter, database/migration, Broadcaster, and Streaming suites; the separately enabled real edge E2E; ten one-worker FFmpeg/Chromium Playwright scenarios; strict source, spec, and application typechecks; all five affected lint scopes; five scoped production builds; Prisma, filtered frozen-lockfile, formatting, and diff validation.
• Increment 7h is complete at the code and local release-gate boundary. The parent increment 7 and RB.3 checkboxes remain open for native publisher and player clients, immersive rendering, CENC/CBCS and vendor DRM, remote-guest, composition, protected-media viewer/cleanup wiring, remaining client conformance/recovery automation, Veritas/V3/Rail tenant equivalence, the consolidation guard, and the complete ingest-to-Rail flow.
• Increment 7i adds an explicit browser/native runtime discriminator to the player and publisher contracts, provider identities, operation fingerprints, and SQL reconstruction boundaries. Migration 00019_live_media_native_clients backfills the existing browser operations, makes the runtime columns mandatory, and constrains native publisher operations to RTMP or SRT while retaining the protocol-specific provider checks. Session-device compatibility is enforced before a player operation can be registered, and publisher provisioning rejects a runtime/protocol mismatch before rotating the active grant.
• Broadcaster can now provision native SRT publishers. The response separates a credential-free SRT resource URL and username from the optional encryption secret, sets no-store, and requires a 10–79-character printable ASCII AES-256 passphrase whenever the endpoint is not loopback. Clear SRT therefore exists only for local integration. The native TypeScript wrapper passes the operation to an isolated Rust executable over standard input; its FFmpeg child receives no publisher credential or passphrase, and MPEG-TS is sent by an in-process, unsafe-code-denying pure-Rust SRT implementation advertising protocol version 1.4.4. Measured send counters must still be corroborated by positive MediaMTX ingress on the exact durable operation before readiness.
• @oshun/live-media/native now supplies a Linux-native HLS/DASH playback component. A memory-only exact-publication-prefix loopback proxy holds the Bearer and gives FFmpeg or ffplay only a one-time local capability. It constrains manifest redirects and every fetch-bearing HLS/DASH reference, filters forwarded headers, streams media without buffering whole segments, bounds redacted diagnostics, and clears its credential buffer during teardown. Actual FFmpeg decode produces the QoE heartbeat evidence; the same proxy also supports an ffplay render session. External DASH XML namespace and schema identifiers remain metadata rather than being rewritten as playable media.
• Increment 7i's release evidence includes green shared live-media, Aphrodite adapter, database/migration, Broadcaster, Viewer, and Streaming suites; a real encrypted cross-implementation SRT socket test; ten one-worker FFmpeg/Chromium Playwright scenarios; strict Rust/TypeScript checks; all six affected lint scopes; six scoped production builds; and Prisma, filtered frozen-lockfile, formatting, and diff validation. The digest-pinned MediaMTX/PostgreSQL edge gate publishes real H.264/AAC MPEG-TS through the Rust SRT client, observes edge ingress, reconstructs and replays the durable publisher operation, decodes protected HLS and DASH through the credential proxy, persists measured QoE, renders HLS with ffplay under Xvfb, and requires non-black captured pixels. The claim is a reusable Linux native execution component for application-shell integration, not a complete mobile application or Tauri UI.
• Increment 7i is complete at the code and local release-gate boundary. The parent increment 7 and RB.3 checkboxes remain open for immersive rendering, CENC/CBCS and vendor DRM, remote-guest, composition, protected-media viewer/cleanup wiring, remaining client conformance/recovery automation, Veritas/V3/Rail tenant equivalence, the consolidation guard, and the complete ingest-to-Rail flow.
• Increment 7j replaces the public process-local VR simulation with a fail-closed retirement gateway and adds the first real bounded immersive client path to the shared organ. @oshun/live-media/browser projects decoded protected media through WebGL for equirectangular 180°/360° flat/cardboard presentation, renders both cardboard eyes from mono/SBS/top-bottom sources, accepts pointer, keyboard, or permission-backed device orientation, and uses a Web Audio analyser plus HRTF/stereo panning. Success requires positive decoded/rendered/audio evidence, non-black readback, distinct initial/oriented frame hashes, and bounded orientation counts. Cubemap/EAC, ambisonics, native immersive clients, and WebXR without a real XR session/frame loop fail closed.
• Aphrodite Viewer now exposes authenticated, no-store immersive register/evidence/release routes under the existing viewer lease. The aphrodite.immersive.v1 control derives its operation identity and all bindings from the exact active succeeded browser player; it never accepts a caller-authored publication, player grant, or provider reference. Migration 00020_live_media_immersive_sessions adds exact player/publication/viewer foreign keys, one active operation per viewer session, forced RLS, database-clock lifecycle and worker leases, immutable bounded evidence, restart replay, reclaim, stale-writer fencing, and explicit release. Durable rows exclude the media Bearer, URLs, raw poses, gaze, location, and headset identifiers.
• Increment 7j's browser release evidence uses generated 1920×960 H.264/AAC stereo HLS and DASH. Single-worker Chromium automation proves real decoded media, WebGL non-black pixels in two distinct eye buffers, view changes from actual CDP device orientation and pointer input while the source is paused, positive Web Audio samples, exact origin/grant containment, axe, mobile, reduced motion, privacy, and ordered immersive/player teardown. The digest-pinned MediaMTX/PostgreSQL gate applies migration 00020, inspects durable proof/secret absence, reconstructs the adapter for replay, recovers an expired execution lease, rejects the stale fence, denies a second tenant, releases on reconnect, and tears down explicitly.
• Increment 7j is complete at the code and local release-gate boundary. The parent increment 7 and RB.3 checkboxes remain open for physical headset/WebXR/native immersive runtimes, capture/stitching and broader projection/audio formats, CENC/CBCS and vendor DRM, remote-guest, composition, protected-media cleanup wiring, Veritas/V3/Rail tenant equivalence, the consolidation guard, and the complete ingest-to-Rail flow.
• Increment 7k retires the unsafe legacy remote-guest network authority and installs the shared, strict one-host/one-guest browser path described above. Aphrodite Broadcaster remains a tenant adapter: it owns authentication, exact-stream authorization, no-store HTTP composition, and the single-node WebSocket gateway, while @oshun/live-media owns the portable contracts, signaling hub, browser peer runtime, bounded evidence, and accessible studio surface. The forced-RLS adapter owns durable one-use capability digests, database-clock lifecycle, reciprocal evidence, replay, fencing, and release.
• Increment 7k's release evidence includes green shared live-media (222), Aphrodite adapter (179), Broadcaster (83), legacy compatibility (6), and migration (3) unit suites; package/spec typechecks; all five affected lint scopes; shared, adapter, compatibility, and Broadcaster production builds; two single-worker Chromium desktop/mobile scenarios; and the supervised real PostgreSQL/MediaMTX integration. The browser gate proves actual reciprocal media and matching SSRC evidence across two browser contexts. The database gate proves one-use/rotation semantics, restart replay, forced RLS, database-clock expiry, lease recovery/fencing, durable secret/signaling non-disclosure, release, and teardown.
• Increment 7k is complete at the code and local release-gate boundary. Parent increment 7 and RB.3 remain open for SFU/TURN/multi-node or native remote-guest expansion if product requirements demand it, composition, CENC/CBCS and vendor DRM, protected-media cleanup wiring, broader immersive runtimes, Veritas/V3/Rail tenant equivalence, and the complete ingest-to-Rail flow.
• Increment 7l adds the first real composition provider and deliberately bounds it to browser execution. @oshun/live-media/browser owns the portable Canvas 2D/Web Audio compositor, exact one-to-four-source contract, deterministic single/grid/two-source picture-in-picture layouts, 640–1920-wide 16:9 output at 15–60 fps, optional audio mixing, derived-stream capture, existing WHIP publication, and accessible full-stage surface. Caller-owned source tracks remain caller-owned during teardown. Custom layouts, scene switching and transitions, GPU/OBS/native composition, SFU/MCU mixing, and multi-node orchestration are explicit non-claims.
• Aphrodite remains a thin tenant control plane. Broadcaster's authenticated, no-store register/evidence/release routes accept only bounded identifiers, output declarations, changed/non-black frame counts, source-region SHA-256 samples, and aggregate audio proof. aphrodite.composition.v1 derives the exact tenant/stream/grant/client binding and succeeds only after the linked browser/WebRTC publisher has succeeded and its exact MediaMTX edge connection is connected with positive ingress. Raw pixels, raw audio, source media, Bearers, SDP, and ICE never enter the durable operation. Publisher teardown cascades composition release.
• Migration 00022_live_media_compositions installs the composite grant/publisher/resource-bound ledger with forced RLS, database-clock lifecycle, one active composition per publisher, semantic replay, reclaimable leases, stale-worker fencing, immutable proof, and repeat-safe release. The single-worker Chromium suite proves two independently changing Canvas sources, distinct non-black output regions, real oscillator evidence, real WHIP/MediaMTX RTP, exact durable binding, axe, keyboard, mobile, reduced-motion, denial, privacy, and ownership-correct teardown. The supervised PostgreSQL/MediaMTX gate applies the migration and proves exact publisher/edge joins, restart replay without attempt inflation, database-clock abandoned-lease recovery, stale-fence rejection, second-tenant denial, durable secret/raw-media absence, repeat-safe release, browser WHIP cleanup, and disconnected-edge reconciliation. All affected unit, integration, strict typecheck, lint, build, frozen-lockfile, and the complete 17-scenario browser suite pass.
• Increment 7l is complete at the code and local release-gate boundary. Parent increment 7 and RB.3 remain open for broader composition runtimes if product requirements demand them, SFU/TURN/multi-node or native remote guests, CENC/CBCS and vendor DRM, broader immersive runtimes, Veritas/V3/Rail tenant equivalence, and the complete ingest-to-Rail flow.
• Increment 7m completes the bounded AES-128 protected-playback and destructive cleanup path without claiming CENC/CBCS or a vendor DRM/CDM stack. Playback grant requests now carry the viewer-selected HLS/DASH protocol. A forced-RLS SQL view selects only the newest active, succeeded encryption operation for the exact ready source publication. HLS grants retain the compatible signed-grant envelope while binding an immutable operation prefix, exact HLS manifest ledger, virtual key object, operation ID, and external key URI; DASH deliberately continues to issue only the clear source grant.
• Browser HLS.js authorizes requests only inside that protected ledger or at the exact signed key URI, including its query, and attaches the memory-only Bearer only after the check. The native loopback proxy rewrites that one key URI to a credential-free local capability and performs the upstream key request itself, keeping the Bearer out of child arguments. Aphrodite Streaming exposes the public /media-origin/segment-keys/:operationId/key boundary. It revalidates the active viewer lease, ready source publication, active protected operation, exact virtual key object, and current custody before recovering exactly 16 bytes. Missing, wrong, stale, releasing, and released requests all return an empty 401; successful responses are no-store, fixed-length octet streams and the recovered control buffer is zeroed after the response owns a copy.
• Migration 00023_live_media_protected_playback_cleanup adds an active → releasing → released state machine, database-clock release lease, durable exact object plan, release timestamps, custody digest, and partial active protected-publication index. The provider verifies its immutable descriptor, persists the plan and fences delivery before deletion, idempotently removes only those protected objects, and atomically shreds wrapped custody after deletion succeeds. A crashed cleaner can reclaim the expired lease without changing the plan; a completed release replays the original database time and the original encryption request cannot resurrect its objects. Source publication objects remain untouched.
• Increment 7m's release evidence includes green shared live-media (229), Aphrodite adapter (187), database/migration (243), Viewer (191), and Streaming (108, with the separately enabled real edge E2E also green) suites; 10 focused single-worker browser-player scenarios; strict source/application typechecks; targeted lint; Prisma validation; Streaming and Viewer production bundles; formatting; and diff validation. Browser automation generates and decodes real AES-128 H.264/AAC HLS through the exact signed key URI and proves a sibling URI is blocked before Bearer disclosure. The supervised PostgreSQL/SoftHSM/FFmpeg/native gate applies migration 00023, reconstructs storage and HSM custody, decodes the protected HLS through the public key route, verifies the 16-byte key response, then proves immediate manifest/key denial, exact protected-object deletion, source preservation, custody shredding, repeat-safe release, and replay rejection. The gate now streams its migration batch over psql stdin so future schema growth is not bounded by the host's single-argument size limit.
• Increment 7m is complete at the code and local release-gate boundary. Parent increment 7 and RB.3 remain open for CENC/CBCS and vendor DRM/CDM licensing, broader optional provider/client runtimes where product requirements demand them, Veritas/V3/Rail tenant equivalence, and the complete ingest-to-Rail flow.
• Increment 8a starts tenant onboarding at the missing identity boundary. @oshun/live-media now owns a strict, immutable, idempotent registry between its canonical tenant/resource UUID and a product-owned external identity. Registration requires the existing stream-create capability; reads and reverse resolution require stream-operate and are tenant-authorized before store access. The memory store and tenant-fixed PostgreSQL adapter reject both resource-side and external-identity conflicts. The registry deliberately has no second stream lifecycle: grants, publications, sessions, and product stream state remain the authorities for their own revocation and teardown.
• Migration 00024_live_media_tenant_resource_registry creates the forced-RLS registry, backfills canonical Aphrodite streams and any already-deployed tenant-tagged substrate rows, normalizes the early operational-event stream UUID to the shared TEXT contract, and replaces all 13 root shared-ledger one-column streams(id) foreign keys with composite (tenant_id, stream_id) references. The Aphrodite-owned chat-filter configuration remains directly product-bound. New Aphrodite publisher-grant issuance idempotently registers its exact stream UUID before the durable grant write.
• Increment 8a's gated digest-pinned PostgreSQL test applies the complete 00005–00024 chain and uses one identical substrate stream UUID across Aphrodite, Veritas, V3 Stage, and V10 Rail. It proves Aphrodite backfill, independent registration for the other three tenants without counterfeit Aphrodite stream rows, durable grant issuance and post-restart authentication, reverse mapping resolution, forced-RLS row visibility, mapping-conflict rejection, an unregistered-resource composite-FK failure, and the live constraint catalog's 13 composite references with no remaining shared-ledger reference to streams. The full shared live-media (232), Aphrodite adapter (190 plus the separately enabled PostgreSQL gate), database (246), and Aphrodite Streaming (108) suites pass, as do focused lint, source and database-spec typechecks, library builds, Prisma validation, formatting, and diff validation. Existing whole-spec typecheck debt outside this change remains in older protected-playback/immersive fixtures and the Streaming E2E tsconfig boundary; the new registry sources and tests report no diagnostics.
• Increment 8a is the SQL identity and credential-equivalence prerequisite, not completion of tenant equivalence. No Veritas/V3/Rail production adapter or Rail player path is claimed yet; the broader optional-provider scopes, full four-tenant behavior suite, and supervised ingest-to-Rail flow remain open.
• Increment 8b removes the remaining Aphrodite-only naming and adapter-ID assumptions from the canonical shared browser and native client surface. Playback, publisher, immersive, remote-guest, and composition descriptors now accept only their kind-correct {tenant}.*.vN adapter identity. Every browser control binds the adapter returned by its initial register or provision call and rejects an adapter swap during heartbeat, evidence, invite exchange, or release. Canonical functions, sessions, surfaces, mounts, and DOM roots use live-media names. The previous Aphrodite* exports remain deprecated exact aliases, so Aphrodite still executes the same tenant-#1 implementation rather than a compatibility fork.
• Contract coverage exercises Veritas playback and immersive identities plus V3 Stage publisher, composition, remote-guest, and native-publisher identities; native playback also accepts a non-Aphrodite tenant. Negative cases reject wrong-kind IDs and mid-lifecycle adapter replacement, while exact-identity assertions prove the old Aphrodite exports alias the canonical functions and classes. The full shared live-media suite passes 243 tests, the Aphrodite adapter passes 190 with one intentional skip, Broadcaster passes 86, Viewer passes 191, and Streaming passes 108 with one intentional skip. All 19 single-worker Chromium scenarios, all 14 V10 Phase A/consolidation cases, shared source and spec typing, affected adapter/application typechecks, package lint, and the dependency-inclusive shared production build pass.
• Increment 8b proves portable client contracts and Aphrodite compatibility; it does not create production Veritas/V3/Rail control planes, provider stores, or a Rail playback lane. Those tenant compositions, broader optional runtimes, and the supervised ingest-to-Rail equivalence gate remain open.
• Increment 8c extracts the media-pipeline command/query façade itself into the canonical shared organ. LiveMediaTenantPipelineJobControl accepts a deployment-supplied canonical job service, fixes one validated tenant plus its operate/manage principals at construction, and exposes no caller-authored tenant or authority field. Aphrodite's previous control is now an exact thin tenant-#1 subclass, with an explicit full-result equivalence test across enqueue, semantic replay, get, list, and cancel. Veritas supplies the first production-shaped tenant-#2 subclass from its existing Rail channel package; runtime-cast Aphrodite options cannot replace its veritas tenant or principal prefix.
• Increment 8c coverage runs Aphrodite and Veritas controls over one canonical pipeline with the same stream UUID and idempotency key, proving independent durable records plus cross-tenant get/list isolation, semantic replay, management authority, invalid-configuration rejection, and exact Veritas request scopes. The final gates pass 246 shared live-media tests, 191 Aphrodite adapter tests with one intentional skip, 86 Veritas channel tests, all 14 V10 Phase A/consolidation tests, source and spec typechecks, targeted lint, dependency-inclusive shared/adapter builds, frozen-lockfile validation, formatting, and diff checks.
• Increment 8c is a real reusable control-plane composition, not a media-byte completion claim. The Veritas rehearsal ingest port is not yet backed by the shared publisher/transcode/publication/viewer path, the V10 first-party-live gate remains not_configured, and V3 Stage plus the Rail playback lane still need production tenant compositions and the supervised ingest-to-playback equivalence gate.
• Increment 8d moves the complete PostgreSQL media-pipeline job state machine into the canonical server-only substrate as SqlLiveMediaPipelineJobStore. The shared store accepts an injected canonical database transaction port and one immutable tenant while preserving forced transaction-local RLS, advisory idempotency serialization, SKIP LOCKED claims, database-clock scheduling and leases, lease-token fencing, cancellation, retry recovery, and terminal settlement. Product-specific configuration and error translation remain thin wrapper responsibilities; Aphrodite's existing constructor and exact TENANT_MISMATCH error are preserved by a 37-line tenant-#1 subclass.
• Increment 8d coverage composes Veritas's tenant-fixed control through the shared service and shared SQL store, proving exact tenant/RLS/advisory/insert bindings, and proves Aphrodite cross-tenant enqueue and list rejection before a transaction begins. The final gates pass 248 shared live-media tests, 191 Aphrodite adapter tests with one intentional skip, 86 Veritas channel tests, all 14 V10 Phase A/consolidation tests, five source/spec/standalone typechecks, targeted shared/adapter lint, dependency-inclusive shared/adapter builds, frozen-lockfile validation, and the digest-pinned real PostgreSQL plus MediaMTX persistence E2E.
• Increment 8d establishes reusable durable control-plane persistence; it does not compose a deployed Veritas database adapter or move Veritas ingest bytes through publication into an HLS viewer. The V10 first-party-live gate remains not_configured, and V3 Stage/Rail production compositions plus the supervised ingest-to-playback equivalence gate remain open.
• Increment 8e moves the durable tenant/resource identity map and publisher credential authority into the canonical server-only substrate as SqlLiveMediaResourceRegistryStore and SqlLiveMediaPublisherGrantStore. Both receive an injected database transaction port, validate and fix one tenant at construction, establish transaction-local forced-RLS context, and reject cross-tenant access before SQL. The registry preserves database-time immutable registration, one tenant-wide advisory lock, exact replay, and crossed-uniqueness conflict rejection. The grant store preserves per-resource advisory serialization, atomic prior-generation revocation, monotonic generation, digest-only lookup, and expected-grant revocation. Product-specific error translation remains an option; Aphrodite's prior constructors and exact TENANT_MISMATCH errors are preserved by thin tenant-#1 subclasses.
• Increment 8e coverage issues and authenticates a deterministic Veritas grant through the shared service and shared SQL port, proves exact RLS/advisory/ insert/digest bindings, registry replay/conflict/get/resolve behavior, and pre-transaction tenant rejection. The existing digest-pinned PostgreSQL gate now directly instantiates the two canonical stores for Aphrodite, Veritas, V3 Stage, and V10 Rail; it maps the same stream UUID, issues isolated grants, proves the full composite-FK catalog and forced-RLS visibility, reconstructs both stores, reauthenticates every secret, rejects an unregistered grant, and tears down. The full affected suites pass 254 shared live-media tests and 191 Aphrodite adapter tests with one intentional skip, plus 86 Veritas channel tests and all 14 V10 Phase A/consolidation tests. Four source/spec typechecks, Nx-aware shared/adapter lint, dependency-inclusive shared/adapter builds, formatting, diff checks, and the digest-pinned real PostgreSQL gate pass.
• Increment 8e removes the Aphrodite-named persistence dependency from the four-tenant identity/credential E2E, but it is not a deployed Veritas/V3/Rail publisher composition. Veritas rehearsal bytes still do not traverse shared edge, publication, viewer, and Rail playback, so first-party-live remains not_configured and the final tenant-equivalence gate remains open.
• Increment 8f moves the durable publisher-edge and media-publication state machines into the canonical server-only substrate as SqlLiveMediaPublisherEdgeSessionStore and SqlLiveMediaPublicationStore. Both accept the canonical database transaction port, fix one validated tenant, establish transaction-local forced-RLS context, and reject cross-tenant work before SQL. The edge store preserves resource-local advisory serialization, exact-connection refresh without revision inflation, atomic replacement, stale-disconnect rejection, and connected-session listing. The publication store preserves publication-local advisory serialization, exact-prefix reservation, durable source metadata, compare-and-swap ready/failed/revoked transitions, and exact terminal replay. Aphrodite's prior constructors, default database, and legacy mismatch messages remain thin tenant-#1 wrappers rather than duplicate state machines.
• Increment 8f coverage exercises the canonical stores directly as Veritas, including exact RLS, advisory-lock, SQL-value, refresh, stale-connection, transition-replay, revocation, prefix, and pre-transaction tenant behavior. Aphrodite coverage additionally proves the exact legacy error classes and messages. The digest-pinned PostgreSQL gate now creates the same stream UUID for Aphrodite, Veritas, V3 Stage, and V10 Rail, then uses the canonical stores to issue a grant, record an SRT edge connection, and reserve an isolated publication for every tenant. Forced-RLS queries expose exactly one row from each authority per tenant; reconstructed store instances reauthenticate each grant and recover the exact connected edge and publishing reservation. The full gates pass 260 shared live-media tests, 192 passing Aphrodite adapter tests with one intentional skip, 86 Veritas channel tests, and all 14 V10 Phase A/consolidation tests, plus four strict source/spec typechecks, Nx-aware shared/adapter lint, dependency-inclusive shared/adapter builds, and the real PostgreSQL gate.
• Increment 8f advances the durable media-byte-path boundary, but the gate does not send real Veritas/V3/Rail bytes through MediaMTX or produce a ready HLS/DASH object ledger. A deployed non-Aphrodite worker/viewer composition, Rail playback, the final tenant-equivalence gate, and the first-party-live flip remain open.
• Increment 8g moves the complete durable viewer-session, QoE, and presence state machine into the canonical server-only substrate as SqlLiveMediaViewerSessionStore. It fixes one validated tenant, establishes transaction-local forced-RLS context, serializes a resource with an advisory lock, takes lifecycle time from PostgreSQL, expires leases and entitlements before mutations, preserves join/refresh/reconnect idempotency, fences heartbeat/leave by the digest-only lease, commits ordered lifecycle events, rejects conflicting or non-monotonic QoE, and derives exact active-session and unique-viewer presence inside the same transaction.
• The former hard dependency on Aphrodite's streams table is now an optional transaction-local presence-projection port. The canonical default owns no product table or counter; Aphrodite's thin tenant-#1 wrapper retains its default database, exact legacy mismatch error, and exact current/peak/total viewer projection. The existing eight Aphrodite SQL-behavior tests run through that wrapper unchanged, while direct Veritas coverage proves RLS/locking, exact insert values, projection delegation, QoE persistence, leave replay, database-time active authority, absence of a product-table mutation, and pre-transaction tenant rejection.
• The digest-pinned PostgreSQL gate now creates an isolated active viewer lease and presence snapshot alongside the resource, grant, edge, and publication rows for Aphrodite, Veritas, V3 Stage, and V10 Rail. Forced-RLS queries expose exactly one viewer row per current tenant; reconstructed canonical stores recover each exact active session and a one-session/one-viewer presence snapshot. The fixture's only streams row remains the migration-managed Aphrodite product identity, and the canonical viewer store succeeds although that minimal product table has no viewer-counter columns. Final gates pass 264 shared live-media tests, 192 passing Aphrodite adapter tests with one intentional skip, 86 Veritas channel tests, and all 14 V10 Phase A/consolidation tests, plus four strict source/spec typechecks, Nx-aware shared/adapter lint, dependency-inclusive shared/adapter builds, formatting, diff checks, and the real PostgreSQL gate.
• Increment 8g establishes reusable durable viewer authority and presence, not completed playback. The four publications remain in publishing; no real non-Aphrodite bytes, ready HLS/DASH ledger, playback grant, decoded player, or Rail lane is claimed. Deployed Veritas/V3/Rail worker/viewer compositions, the final tenant-equivalence gate, and first-party-live remain open.
• Increment 8h moves the complete durable live-chat persistence state machine into the canonical server-only substrate as SqlLiveMediaChatStore. It fixes one validated tenant, establishes transaction-local forced-RLS context, takes lifecycle time from PostgreSQL, and serializes resource and ordered-event mutations with advisory locks. It preserves viewer-session- and entitlement-bound membership, digest-only rotating leases, join/heartbeat/ reconnect/leave/expiry/revocation, database-derived presence, bounded per-member rate limits, immutable message idempotency, moderation-bound text, server messages, deletion, room clearing, history, and the durable ordered event outbox/poll cursor.
• Aphrodite's former store is now a thin tenant-#1 subclass that retains its default database, constructor, and exact legacy mismatch error. Its product-owned filter and policy configuration still supplies moderation decisions; it no longer owns a second SQL chat state machine. Four direct Veritas tests prove exact RLS and lock context, membership/presence/event SQL, moderated message replay without duplicate rate or event writes, database-time reads, durable event polling, and pre-transaction tenant rejection. All ten existing Aphrodite SQL behavior tests pass through the wrapper with exact error compatibility.
• The digest-pinned four-tenant PostgreSQL gate now joins an isolated active membership and publishes a system message for Aphrodite, Veritas, V3 Stage, and V10 Rail. Forced-RLS queries expose exactly one membership, one message, and two ordered events for the current tenant. Reconstructed stores recover the exact digest-authenticated message history, one-member/one-participant presence, and ordered membership_joined then message_created cursor after database restart. The dedicated live-chat PostgreSQL concurrency/replay/ expiry/moderation/recovery gate also passes. Final gates pass 268 shared live-media tests, 192 passing Aphrodite adapter tests with one intentional skip, 59 passing Aphrodite chat tests with one intentional skip, 86 Veritas channel tests, and all 14 V10 Phase A/consolidation tests, plus five strict source/spec typechecks, shared/adapter/chat lint, dependency-inclusive shared/adapter/chat builds, formatting, diff checks, and both real PostgreSQL gates.
• Increment 8h establishes reusable durable chat authority, not a completed non-Aphrodite broadcast. The four publications remain in publishing; no real Veritas/V3/Rail bytes, ready HLS/DASH ledger, playback grant, decoded player, or Rail lane is claimed. Operational chat hooks/telemetry remain Aphrodite-named, and deployed non-Aphrodite composition, final tenant equivalence, and first-party-live remain open.
• Increment 8i moves the complete durable operational event ledger and hook outbox into the canonical server-only substrate as SqlLiveMediaOperationalTelemetryStore. It fixes one validated tenant, establishes transaction-local forced-RLS context, atomically persists an event and its selected configured deliveries, and preserves advisory-lock semantic idempotency, conflict fingerprints, a monotonic database sequence, exact tenant/resource queries, database-clock SKIP LOCKED claim and reclaim, final-attempt-expiry dead-lettering, and lease-fenced completion, failure, and retry transitions.
• Aphrodite's former telemetry store is now a thin tenant-#1 subclass retaining its default database, positional constructor, and exact legacy mismatch error. Aphrodite's notification/moderation hook registrations and providers remain product-owned, but it no longer owns a second SQL state machine. The extraction also removes stale UUID stream casts left after migration 00024 normalized the registry stream key to text. Five direct Veritas tests prove exact RLS, idempotency, query, claim, lease, and pre-SQL tenant behavior, including the text-key regression; all five existing Aphrodite SQL-behavior tests pass through the wrapper with exact error compatibility.
• The digest-pinned four-tenant PostgreSQL gate now commits one isolated publisher-connected event and one pending rail.audit delivery for Aphrodite, Veritas, V3 Stage, and V10 Rail. Forced-RLS queries expose exactly one event and one hook for the current tenant. Reconstructed canonical stores recover the exact event after restart, claim the matching delivery with a fresh lease, and complete it with its provider reference. The dedicated live-chat PostgreSQL gate also proves concurrent hook claiming, retry/dead-letter transitions, bounded body-free hook content, and cross-tenant rejection through the compatibility wrapper. Final gates pass 273 shared live-media tests, 192 passing Aphrodite adapter tests with one intentional skip, 59 passing Aphrodite chat tests with one intentional skip, 86 Veritas channel tests, and all 14 V10 Phase A/consolidation tests, plus five strict source/spec typechecks, shared/adapter/chat lint, dependency-inclusive shared/adapter/chat builds, formatting, diff checks, and both real PostgreSQL gates.
• Increment 8i establishes reusable durable telemetry and hook authority, not deployed Veritas/V3/Rail hook providers or a completed non-Aphrodite broadcast. The four publications remain in publishing; no real Veritas/V3/Rail bytes, ready HLS/DASH ledger, playback grant, decoded player, Rail lane, final tenant-equivalence gate, or first-party-live flip is claimed.
• Increment 8j moves the remaining viewer-session, operational-telemetry, and playback-grant authority facades into the canonical substrate as LiveMediaTenantViewerSessionControl, LiveMediaTenantOperationalTelemetryControl, and the server-only LiveMediaTenantPlaybackGrantControl. Each fixes and validates one tenant and principal at construction, mints exact request scopes internally, validates stream/publication identities, and exposes no runtime tenant or capability override. The viewer control preserves join, heartbeat/QoE, leave, active authority, presence, and semantic lifecycle telemetry over the canonical service/store ports. The operational control preserves strict event creation, configured durable hook selection, and idempotent replay. The playback control delegates only an allowed entitlement bound to the exact publication and viewer session.
• Aphrodite's three prior controls are now constructor-compatible tenant-#1 wrappers over those shared facades. Its default SQL telemetry store, notification/moderation hook registrations, exact principals, viewer timing and random-ID seams, and playback service injection remain unchanged. Direct shared tests exercise V10 Rail viewer/QoE/telemetry and Veritas/V3/Rail grant delegation, same-stream cross-tenant isolation, idempotent hook creation, and invalid fixed authority. Existing Aphrodite operational, protected-playback, and 105-test viewer integration behavior remains green.
• The digest-pinned four-tenant PostgreSQL gate now enters viewer joins and restart active/presence reads through tenant-fixed viewer controls, and enters operational event/hook writes through tenant-fixed telemetry controls for Aphrodite, Veritas, V3 Stage, and V10 Rail. The existing canonical stores still prove forced-RLS visibility and restart recovery, claim, and completion. Final gates pass 279 shared live-media tests, 192 passing Aphrodite adapter tests with one intentional skip, 59 passing Aphrodite chat tests with one intentional skip, 105 Aphrodite viewer integration tests, 86 Veritas channel tests, and all 14 V10 Phase A/consolidation tests. Eight strict source/spec typechecks, graph-aware shared/adapter lint, dependency-inclusive shared/adapter builds, the direct viewer production bundle, formatting/diff checks, and both real PostgreSQL gates pass.
• Increment 8j establishes reusable tenant-fixed runtime entry points, not deployed Veritas/V3/Rail viewer, grant, or hook-provider compositions. The four publications remain publishing; no real non-Aphrodite ingest bytes, ready HLS/DASH ledger, issued real playback grant, decoded Rail player, final tenant-equivalence gate, or first-party-live flip is claimed.
• Increment 8k moves publisher-grant issuance/registration and transcode execution authority behind the canonical server-only LiveMediaTenantPublisherGrantControl and LiveMediaTenantTranscodeExecutionControl. Each validates and fixes one tenant at composition time and exposes no runtime tenant or capability override. The publisher control also fixes the owning product and product-resource mapping, registers that immutable mapping before secret issuance, and binds authenticate/rotate/revoke to the same tenant. The transcode control fixes its worker principal and absolute operator-owned output root, then creates the operate scope, execution identity, exact tenant/resource, and tenant-namespaced file URI internally.
• Aphrodite's publisher-grant and transcode controls are now thin constructor-compatible tenant-#1 wrappers. They retain the existing SQL defaults, optional injected registry behavior, exact owner mapping, principal, output-root error, clock, and random-ID seams used by streaming, broadcaster, and the MediaMTX release gate. Seven direct canonical tests exercise same-stream Veritas/V3 isolation, product mapping, V10 Rail management authority, invalid fixed configuration, and exact Veritas/V3/Rail transcode scope/output ownership. All existing Aphrodite compatibility, streaming, and broadcaster test targets remain green.
• The digest-pinned four-tenant PostgreSQL gate now enters resource registration plus grant issuance and restart authentication through a tenant-fixed publisher control for Aphrodite, Veritas, V3 Stage, and V10 Rail. It still proves forced-RLS visibility, immutable mapping conflict, unregistered-resource foreign-key rejection, and recovery of every downstream authority. The digest-pinned MediaMTX/PostgreSQL gate also passes through Aphrodite's thin transcode wrapper and its real worker/output path. Final gates pass 286 shared live-media tests, 192 passing Aphrodite adapter tests with one intentional skip, the full Aphrodite streaming and broadcaster test targets, 86 Veritas channel tests, and all 14 V10 Phase A/consolidation tests. Six strict source/spec/consumer typechecks, graph-aware shared/adapter lint, dependency-inclusive shared/adapter builds, direct streaming/broadcaster production bundles, formatting/diff checks, and both real container gates pass.
• Increment 8k completes reusable tenant-fixed publisher credential and transcode execution entry points; it does not deploy Veritas/V3/Rail ingest or workers. The four synthetic publications remain publishing; real non-Aphrodite bytes, ready HLS/DASH ledger state, issued playback grants, decoded Rail playback, deployed tenant compositions, final tenant equivalence, and the first-party-live flip remain open.
• Increment 8l moves publisher-edge callback and reconciliation authority behind the canonical LiveMediaTenantPublisherEdgeControl. The control validates and fixes one tenant and edge principal at construction, parses every stream identity, creates operate scopes internally, and binds connect, disconnect, provider snapshot validation, and authoritative reconciliation to that tenant. Its optional telemetry writer preserves the established stable publisher/live and disconnected/ended event identities from the durable edge connection and revision.
• Aphrodite's former publisher-edge implementation is now an exact thin tenant-#1 constructor wrapper. It retains the default forced-RLS SQL store, default operational telemetry, injected-service telemetry opt-out, principal, clock, request-ID seam, routes, and errors while inheriting all edge behavior from the shared control. Direct canonical tests prove same-stream Veritas/V3 isolation, duplicate telemetry identity, V10 Rail authoritative reconciliation, and invalid fixed authority. The four-tenant PostgreSQL gate now enters every durable publisher observation through a tenant-fixed edge control rather than calling the SQL store mutation directly.
• Increment 8l gates pass all 289 shared live-media tests and 192 passing Aphrodite adapter tests with one intentional skip, including the unchanged publisher-edge store and operational-emission oracles. The full Aphrodite Streaming target, 86 Veritas channel tests, and all 14 V10 Phase A/ consolidation tests pass. Six strict shared/adapter/Streaming/Veritas typechecks, graph-aware shared/adapter lint, dependency-inclusive shared and adapter builds, the direct Streaming production bundle, formatting and diff checks, the digest-pinned four-tenant PostgreSQL gate, and the digest-pinned real MediaMTX/PostgreSQL gate also pass.
• Increment 8l supplies a reusable edge-runtime entry point, not a deployed Veritas/V3/Rail edge or complete broadcast composition. The synthetic publications remain publishing; real non-Aphrodite ingress bytes, ready HLS/DASH, playback grants, decoded Rail playback, tenant equivalence, and the first-party-live flip remain open.
• Increment 8m moves the remaining media-publication command/query authority behind the canonical LiveMediaTenantMediaPublicationControl. The control validates and fixes one tenant plus its worker, reader, and manager principals at construction, validates every stream/publication identity, generates request and publication identities internally, and binds publish, get, and revoke to that tenant. Its narrow operations port lets product compositions retain the canonical publication service without exposing a runtime tenant, resource, timestamp, or capability override.
• AphroditeMediaPublicationControl now inherits publish/get/revoke behavior from that shared control as a tenant-#1 wrapper. Its existing constructor, deterministic clock/random seams, public method shapes, and legacy issuePlaybackGrant behavior remain compatible; that grant method is marked deprecated and retained only as a transition shim. The current protected viewer path continues to use the separate protocol-aware AphroditePlaybackGrantControl, so the extraction does not create or loosen a second modern grant authority.
• Three direct canonical tests drive a real in-process MediaPublicationService and prove same-stream/same-publication-ID Veritas/V3 isolation through ready object ledgers and tenant-local revocation, fixed V10 Rail scopes and caller authority replacement, and invalid fixed-authority rejection. Increment 8m gates pass all 292 shared live-media tests and 192 passing Aphrodite adapter tests with one intentional skip, including the unchanged Aphrodite publication/grant compatibility oracle. The full Aphrodite Streaming target, 86 Veritas channel tests, and all 14 V10 Phase A/consolidation tests pass. Six strict shared/adapter/Streaming/Veritas typechecks, graph-aware shared/adapter lint, dependency-inclusive shared and adapter builds, the direct Streaming production bundle, formatting and diff checks, the digest-pinned four-tenant PostgreSQL gate, and the digest-pinned real MediaMTX/PostgreSQL publication gate also pass.
• Increment 8m supplies reusable tenant-fixed publication orchestration, not a deployed Veritas/V3/Rail publication worker or a complete non-Aphrodite broadcast. Its multi-tenant unit evidence uses deterministic packaged-object metadata rather than real non-Aphrodite media bytes. Ready non-Aphrodite HLS/DASH, issued playback grants, decoded Rail playback, deployed tenant compositions, final tenant equivalence, and the first-party-live flip remain open.
• Increment 8n moves the remaining live-chat command/query authority behind the canonical LiveMediaTenantLiveChatControl. The control validates and fixes one tenant plus its presence, system, payment-service, and fanout principals at construction; validates every stream/session/message/participant identity; creates request scopes internally; and binds join, viewer resolution, heartbeat, leave, moderation, messaging, deletion, clearing, presence, expiry, system/tip publication, and event polling to that tenant. Its operational telemetry projection preserves the established stable event identities and never includes message content.
• AphroditeLiveChatControl is now a thin tenant-#1 compatibility wrapper. It retains the existing constructor, exact Aphrodite error class/name/codes, SQL-backed participant identity, entitlement and moderator policy, content filter, service tuning, routes, socket runtime, and operational telemetry seams. Five direct canonical tests prove same-stream/session/message-key Veritas/V3 isolation over one store, tenant-local moderation, presence and event cursors, fixed V10 Rail system/tip principals, fixed policy scopes, content-free telemetry, invalid authority rejection, and typed denials. The Aphrodite runtime compatibility test additionally proves the wrapper still emits the exact product error instance.
• Increment 8n gates pass all 297 shared live-media tests, 192 passing Aphrodite adapter tests with one intentional skip, 60 passing Aphrodite Chat tests with one intentional skip, 86 Veritas channel tests, and all 14 V10 Phase A/ consolidation tests. Six strict shared/adapter/Chat/Veritas source, spec, and consumer typechecks, graph-aware shared/adapter/Chat lint, dependency- inclusive shared/adapter/Chat builds, formatting and diff checks, the dedicated real Chat/PostgreSQL policy-store gate, and the four-tenant durable PostgreSQL registry gate also pass.
• Increment 8n supplies reusable tenant-fixed chat orchestration, not deployed Veritas/V3/Rail chat policies, socket runtimes, hook providers, or a complete non-Aphrodite broadcast. No real non-Aphrodite chat use or media bytes, ready HLS/DASH ledger, playback grant, decoded Rail playback, final tenant equivalence, or first-party-live flip is claimed.
• Increment 8o moves content-analysis probe, analyze, and teardown authority behind the canonical LiveMediaTenantContentAnalysisControl. The control validates and fixes one tenant and one adapter ID at construction, validates every principal/stream/publication/object/operation input, creates the exact operate scope and tenant resource internally, and reconstructs the content-analysis request so callers cannot replace tenant, adapter, kind, capability, or resource authority. The shared input schema and operations port keep provider, binding, storage, and advisory-policy composition replaceable without duplicating command authority.
• AphroditeContentAnalysisControl is now a thin tenant-#1 wrapper fixing aphrodite.content-analysis.v1. It retains the exact constructor, input schema/type exports, timing and request-ID seams, publication binding verifier, advisory policy, provider, forced-RLS queue, worker, and Streaming routes. The compatibility oracle supplies attempted Veritas tenant/adapter options and proves the wrapper still fixes Aphrodite before execution.
• Three direct canonical tests drive one real LiveMediaOptionalAdapterService with independent in-process Veritas and V3 Stage providers. Equal stream, publication, operation, request, and idempotency identities reach only the fixed tenant/adapter/provider and binding, retain exact operate scopes, and tear down independently. V10 Rail caller-override attempts, unsafe principals, and malformed fixed tenant/adapter configuration fail before operations access.
• Increment 8o gates pass all 300 shared live-media tests, 192 passing Aphrodite adapter tests with one intentional skip, 108 passing Aphrodite Streaming tests with one intentional real-edge skip, 86 Veritas channel tests, and all 14 V10 Phase A/consolidation tests. Six strict shared/adapter/Streaming/Veritas source, spec, and consumer typechecks, graph-aware shared/adapter/Streaming lint, dependency-inclusive shared (+6), adapter (+13), and Streaming (+14) builds, formatting/diff checks, and the digest-pinned real MediaMTX/ PostgreSQL/FFmpeg content-analysis gate also pass.
• Increment 8o supplies reusable content-analysis command authority, not a deployed Veritas/V3/Rail analyzer, binding policy, durable queue, worker, or real non-Aphrodite analysis. The real gate remains Aphrodite tenant #1. No non-Aphrodite media bytes, ready HLS/DASH ledger, playback grant, decoded Rail playback, final tenant equivalence, or first-party-live flip is claimed.
• Increment 8p moves recording admission, query, and worker execution authority behind the canonical LiveMediaTenantRecordingControl and LiveMediaTenantRecordingWorker. Both validate and fix one tenant plus one adapter ID at construction. The control owns the strict input schema, exact operate scope/resource/request, publisher-connection binding check, readiness gate, canonical semantic fingerprint, bounded retry budget, durable queue reservation, and tenant-local operation read. The worker reparses every durable request and rejects a tenant or adapter mismatch before provider execution; its service principal, request identity, clock, and shutdown seam remain composition-owned.
• AphroditeRecordingControl and AphroditeRecordingWorker are now thin tenant-#1 wrappers fixing aphrodite.recording.v1. They retain their exact constructors, input schema/type exports, forced-RLS record validation and queue, publisher-connection binding verifier, MediaMTX source authority, retention policy, FFmpeg executor, create-only object store, scheduler, routes, timing/ID seams, and cancellation behavior. The legacy aphroditeRecordingFingerprint now delegates to the shared canonical fingerprint. Compatibility tests supply attempted Veritas tenant/adapter and parser overrides and prove Aphrodite remains fixed at admission and worker execution.
• Three direct canonical tests drive one real LiveMediaOptionalAdapterService with independent in-process Veritas and V3 Stage recording providers and tenant views over one record map. Equal stream, operation, recording, publisher-connection, request, and idempotency identities remain isolated in queue keys, fingerprints, bindings, worker scopes, provider selection, and results. Caller authority overrides, unsafe principals, malformed fixed authority, and mismatched durable work fail before queue mutation or provider execution. The digest-pinned MediaMTX/PostgreSQL/FFmpeg gate now admits the real Aphrodite capture through the thin control and executes it through the thin worker before independently probing the resulting H.264/AAC MP4 and retaining the existing replay, lease-recovery, fencing, tenant-denial, and teardown evidence.
• Increment 8p gates pass all 303 shared live-media tests, 192 passing Aphrodite adapter tests with one intentional skip, 108 passing Aphrodite Streaming tests with one intentional real-edge skip, 86 Veritas channel tests, and all 14 V10 Phase A/consolidation tests. Six strict shared, adapter, Streaming, and Veritas source, spec, and consumer typechecks; graph-aware shared, adapter, and Streaming lint; dependency-inclusive shared (+6), adapter (+13), and Streaming (+14) builds, formatting/diff checks, and the digest-pinned real MediaMTX/PostgreSQL/FFmpeg recording gate also pass.
• Increment 8p establishes reusable recording command and worker authority, not deployed Veritas/V3/Rail recording sources, retention policies, durable stores, workers, or real non-Aphrodite capture. Its multi-tenant evidence uses in-process providers; the real gate remains Aphrodite tenant #1. No ready non-Aphrodite HLS/DASH, playback grant, decoded Rail playback, final tenant equivalence, or first-party-live flip is claimed.
• Increment 8q moves segment-encryption probe/admission/query, protected-key delivery, repeat-safe release, and worker execution authority behind the canonical LiveMediaTenantSegmentEncryptionControl and LiveMediaTenantSegmentEncryptionWorker. Both validate and fix one tenant and adapter ID at construction. The control owns the strict input schema, exact operate scope/resource/request, static-policy and publication-binding checks, readiness gate, canonical semantic fingerprint, bounded retry budget, durable reservation/read, exact active-succeeded-custody key gate, and signed optional- adapter teardown. Every read and worker claim is reparsed and rejected when its operation/resource/tenant/adapter identity or durable fingerprint differs from the fixed composition, before custody recovery or provider execution.
• AphroditeSegmentEncryptionControl and AphroditeSegmentEncryptionWorker are now thin tenant-#1 wrappers fixing aphrodite.segment-encryption.v1. They retain their exact constructors, input schema/type exports, product error class and codes, forced-RLS operation record parser/queue, static AES-128 policy, PKCS#11 custody, key-delivery and release routes, provider, scheduler, and timing/request-ID seams. The legacy aphroditeSegmentEncryptionFingerprint now delegates to the shared canonical fingerprint. Existing compatibility tests still prove policy-before-binding, exact 128-bit active-custody delivery, releasing/released denial, signed repeat-safe teardown, and tenant-fixed worker scope.
• Three direct canonical tests drive one real LiveMediaOptionalAdapterService with independent in-process Veritas and V3 Stage providers and tenant views over one record map. Equal stream, publication, operation, request, and idempotency identities remain isolated in queue keys, fingerprints, binding checks, worker scopes, provider selection, results, key URIs/bytes, and teardown. V10 Rail caller-authority overrides, unsafe principals, mismatched policy, malformed fixed authority, cross-tenant durable records, and stale fingerprints fail before queue mutation, custody recovery, or provider access. The digest-pinned MediaMTX/PostgreSQL/SoftHSM/FFmpeg/Chromium gate now admits the real ready Aphrodite HLS publication through the thin control and executes its AES-128 transform through the thin worker before independently decoding H.264/AAC playback. It retains reconstruction replay, exact viewer/key authorization and non-disclosure, sibling denial, lease recovery, stale-writer fencing, RLS tenant denial, source-preserving destructive cleanup, custody shredding, and clean teardown.
• Increment 8q gates pass all 306 shared live-media tests, 192 passing Aphrodite adapter tests with one intentional skip, 108 passing Aphrodite Streaming tests with one intentional real-edge skip, 86 Veritas channel tests, and all 14 V10 Phase A/consolidation tests. Six strict shared, adapter, Streaming, and Veritas source/spec/consumer typechecks; graph-aware shared, adapter, and Streaming lint; dependency-inclusive shared (+6), adapter (+13), and Streaming (+14) builds; formatting/diff checks; and the supervised real container/media/ browser gate pass.
• Increment 8q establishes reusable segment-encryption command, key-delivery, release, and worker authority, not deployed Veritas/V3/Rail key policies, custody backends, queues, workers, or real non-Aphrodite encryption. Its multi-tenant evidence uses in-process providers; the real gate remains Aphrodite tenant #1. CENC, CBCS, external vendor DRM/CDM licensing, ready non-Aphrodite HLS/DASH, playback grants, decoded Rail playback, final tenant equivalence, and the first-party-live flip remain open.
• Increment 8r moves visible-watermark probe/admission/query, repeat-safe release, and worker execution authority behind the canonical LiveMediaTenantWatermarkControl and LiveMediaTenantWatermarkWorker. Both validate and fix one tenant and adapter ID at construction. The control owns the strict input schema, exact operate scope/resource/request, policy-derived profile/payload/key references, publication and viewer binding checks, readiness gate, canonical semantic fingerprint, bounded retry budget, durable reservation/read, and signed optional-adapter teardown. Every returned record and worker claim is reparsed and rejected when its operation, resource, tenant, adapter, or fingerprint differs from the fixed composition, before release or provider execution.
• AphroditeWatermarkControl and AphroditeWatermarkWorker are now thin tenant-#1 wrappers fixing aphrodite.watermark.v1. They retain their exact constructors, input schema/type exports, Aphrodite operation error class and codes, forced-RLS operation record parser/queue, visible-grid policy, PKCS#11 custody, FFmpeg transformer, binding verifier, routes, scheduler, and timing/request-ID seams. The legacy aphroditeWatermarkFingerprint delegates to the shared canonical fingerprint. Compatibility tests retain policy- derived admission, durable release timestamps, authenticated worker scope, and the exact Aphrodite invalid-release error contract.
• Three direct canonical tests drive one real LiveMediaOptionalAdapterService with independent in-process Veritas and V3 Stage watermark providers and tenant views over one record map. Equal stream, operation, publication, viewer-session, source-object, request, and idempotency identities remain isolated in queue keys, fingerprints, binding checks, worker scopes, provider selection, results, and teardown. V10 Rail caller-authority overrides, unsafe principals, mismatched policy, malformed fixed authority, cross-tenant durable records, and stale fingerprints fail before queue mutation, release, or provider access. The supervised MediaMTX/PostgreSQL/SoftHSM/FFmpeg gate now admits the real Aphrodite source through the thin control, applies its visible watermark through the thin worker, and performs destructive release through the reconstructed control. It retains real 64-cell extraction and luma-PSNR evidence, restart replay, lease recovery, stale-writer fencing, plaintext token/key non-disclosure, RLS tenant denial, exact output deletion, resurrection denial, and clean teardown.
• Increment 8r gates pass all 309 shared live-media tests, 193 passing Aphrodite adapter tests with one intentional skip, 108 passing Aphrodite Streaming tests with one intentional real-edge skip, 86 Veritas channel tests, and all 14 V10 Phase A/consolidation tests. Six strict shared, adapter, Streaming, and Veritas source/spec/consumer typechecks; graph-aware shared, adapter, and Streaming lint; dependency-inclusive shared (+6), adapter (+13), and Streaming (+14) builds; formatting/diff checks; and the supervised real container/media gate pass.
• Increment 8r establishes reusable visible-watermark command, release, and worker authority, not deployed Veritas/V3/Rail watermark policies, custody backends, queues, workers, or real non-Aphrodite transforms. Its multi-tenant evidence uses in-process providers; the real gate remains Aphrodite tenant #1. The visible-grid profile is not invisible or forensically robust. Ready non-Aphrodite HLS/DASH, playback grants, decoded Rail playback, final tenant equivalence, and the first-party-live flip remain open.
• Increment 8s moves player-grant registration, decoded-media observation, synchronous provider execution, and release authority behind the canonical LiveMediaTenantPlayerClientControl. The control validates and fixes one tenant, adapter, and service principal at construction. It reparses the playback grant, active leased viewer session, QoE sample, player request, and every durable queue result. Registration binds tenant, stream, session ID, subject, client instance, protocol, publication, grant, runtime, readiness, lease expiry, and a canonical exact-issuance fingerprint before reservation. Observation admits provider execution only after positive playing-state decoded-frame evidence is durably staged, then requires a matching succeeded record. Release likewise validates the active operation before teardown and requires its matching durable released state. Cast or unknown runtimes remain unsupported no-ops rather than fabricated clients.
• AphroditePlayerClientControl is now a thin tenant-#1 wrapper fixing aphrodite.player-client.v1 and the aphrodite-player-client-service principal after caller options are spread. It retains its public constructor and operation alias, exact Aphrodite error factory, forced-RLS PostgreSQL operation store/parser, lease and fencing provider, positive-QoE evidence path, browser/native HLS/DASH runtime references, protected-playback composition, and routes. The legacy aphroditePlayerClientFingerprint now delegates to the shared canonical implementation. An adversarial compatibility case proves runtime-only tenant, adapter, service-principal, parser, and descriptor overrides cannot weaken that wrapper authority, while repeat registration and product error behavior remain compatible.
• Three direct canonical tests drive one real LiveMediaOptionalAdapterService with independent in-process Veritas and V3 Stage player providers and tenant queue views over one record map. Equal stream, publication, session, grant, QoE-event, operation, and request identities remain isolated in queue keys, fingerprints, binding verification, service scopes, provider selection, results, evidence, and release. Cross-tenant grant/session resources, subject mismatches, caller-injected authority, malformed fixed IDs, unsupported cast, wrong durable tenant/adapter records, and stale fingerprints fail before queue mutation or provider execution/teardown. The supervised real MediaMTX/PostgreSQL/SoftHSM/FFmpeg/Chromium gate exercises the reconstructed Aphrodite wrapper from protected-playback grant issuance and registration through positive decoded DASH QoE, synchronous execution, replacement release, durable proof, forced-RLS sibling denial, and final release while retaining the broader real-media, custody, recovery, fencing, and cleanup assertions.
• Increment 8s gates pass all 312 shared live-media tests, 194 passing Aphrodite adapter tests with one intentional skip, 108 passing Aphrodite Streaming tests with one intentional real-edge skip, 86 Veritas channel tests, and all 14 V10 Phase A/consolidation tests. Six strict shared, adapter, Streaming, and Veritas source/spec/consumer typechecks; graph-aware shared, adapter, and Streaming lint; dependency-inclusive shared (+6), adapter (+13), and Streaming (+14) builds; formatting/diff checks; and the supervised real container/media/browser gate pass.
• Increment 8s establishes reusable player lifecycle authority, not deployed Veritas/V3/Rail player providers, durable stores, policies, or decoded client runtimes. Its multi-tenant evidence uses in-process providers; the real gate remains Aphrodite tenant #1. Ready non-Aphrodite HLS/DASH, non-Aphrodite playback grants, decoded Rail playback, final tenant equivalence, and the first-party-live flip remain open.
• Increment 8t moves active publisher-grant registration, independently authenticated edge binding, positive runtime-evidence staging, synchronous provider execution, query, and repeat-safe release behind the canonical LiveMediaTenantPublisherClientControl. The control validates and fixes one tenant, adapter, and service principal at construction. It reparses the non-revoked, unexpired publisher grant before readiness access; derives the exact resource and operation/grant identity; validates the browser/native runtime/protocol pair; and owns the canonical exact-issuance fingerprint, queue reservation, and durable replay validation. Authenticated binding strictly validates edge/connection identity, exact protocol, and a timestamp that cannot predate issuance while retaining the legacy unregistered-grant no-op. Observation always passes through durable evidence staging so the queue can revalidate independent grant and edge authority even for succeeded replay, then admits execution only after two-sided evidence and requires the matching durable succeeded state. Query and teardown likewise reparse and validate the fixed tenant, stream, adapter, operation/grant identity, and fingerprint before returning or invoking a provider.
• AphroditePublisherClientControl is now a thin tenant-#1 wrapper fixing aphrodite.publisher-client.v1, the aphrodite-publisher-client-service principal, product error factory, record parser, and descriptor after caller options are spread. It retains its public constructor and operation alias, exact Aphrodite errors, forced-RLS PostgreSQL queue, active-grant and authenticated MediaMTX edge binding, durable two-sided evidence, leasing/fencing provider, browser-WHIP and native-SRT runtime references, runtime composition, Streaming ingest routes, and Broadcaster store integration. The legacy aphroditePublisherClientFingerprint now delegates to the shared canonical implementation. An adversarial compatibility case proves runtime-only tenant, adapter, principal, parser, descriptor, and error-factory overrides cannot weaken the wrapper while repeat registration, active-grant revalidation, product errors, and repeat-safe release remain compatible.
• Three direct canonical tests drive one real LiveMediaOptionalAdapterService with independent in-process Veritas and V3 Stage publisher providers and tenant queue views over one record map. Equal stream, grant, client, edge, connection, sample, operation, and request identities remain isolated in queue keys, fingerprints, service scopes, binding verification, provider selection, evidence, results, query, and teardown. Cross-tenant, revoked, and expired grants; malformed fixed IDs and edge input; browser/SRT mismatch; wrong durable tenant/adapter records; and stale fingerprints fail before queue mutation, binding, execution, query, or teardown. The supervised real MediaMTX/PostgreSQL/SoftHSM/FFmpeg/Chromium gate exercises the reconstructed Aphrodite wrapper through native-SRT registration, independently authenticated exact edge binding, positive client/ingress evidence, synchronous execution, process reconstruction/replay, forced-RLS sibling denial, and release. The same gate retains browser-WHIP publication and the wider encrypted/watermarked/protected-media, recovery, fencing, and cleanup assertions.
• Increment 8t gates pass all 315 shared live-media tests, 195 passing Aphrodite adapter tests with one intentional skip, 108 passing Aphrodite Streaming tests with one intentional real-edge skip, 86 Broadcaster tests, 86 Veritas channel tests, and all 14 V10 Phase A/consolidation tests. Eight strict shared, adapter, Streaming, Broadcaster, Veritas, and Phase A source, spec, and consumer typechecks; graph-aware lint for all six projects; dependency-inclusive shared (+6), adapter (+13), Streaming (+14), and Broadcaster (+16) builds; formatting/diff checks; and the supervised real container/media/browser gate pass.
• Increment 8t establishes reusable publisher lifecycle authority, not deployed Veritas/V3/Rail publisher providers, durable stores, grant/edge integrations, or browser/native client runtimes. Its multi-tenant evidence uses in-process providers; the real gate remains Aphrodite tenant #1. Ready non-Aphrodite HLS/DASH, playback grants, decoded Rail playback, final tenant equivalence, and the first-party-live flip remain open.
• Increment 8u moves host registration, one-use invitation exchange, signaling authority, reciprocal transport-evidence staging, synchronous provider execution, query, and repeat-safe release behind the canonical LiveMediaTenantRemoteGuestControl. The control validates and fixes one tenant, adapter, service principal, and credential-free secure WebSocket base at construction. It generates operation/session identities and raw capabilities internally; owns the compatible canonical semantic registration and exact exchange fingerprints, readiness scope, digest-only queue boundary, role-correct two-sided evidence gate, and durable success/release validation; fixes signaling claims to its tenant; and reparses every returned record to reject a wrong tenant, stream, adapter, operation/session/grant/client identity, or fingerprint before returning a descriptor or invoking downstream authority.
• AphroditeRemoteGuestControl is now a thin tenant-#1 wrapper fixing aphrodite.remote-guest.v1, the aphrodite-remote-guest-service principal, product error factory, record parser, and descriptor after caller options are spread. It retains its public constructor and session aliases, exact Aphrodite error class/codes, forced-RLS PostgreSQL queue, active publisher grant binding, database-clock lifecycle, one-use invitation, ticket, and guest lease digest rotation, WebSocket hub, leasing/fencing provider, Broadcaster routes, and two-browser WebRTC runtime. The legacy registration and exchange fingerprints now delegate to their shared canonical implementations. An adversarial compatibility case proves runtime-only tenant, adapter, principal, parser, descriptor, and error-factory overrides cannot weaken the wrapper while released-registration replay still emits the exact product error.
• Three direct canonical tests drive one real LiveMediaOptionalAdapterService with independent in-process Veritas and V3 Stage remote-guest providers and tenant queue views over one record map. Equal stream, grant, operation, session, host/guest client, invitation, signaling, evidence, and request identities remain isolated in queue keys, fingerprints, service scopes, binding verification, provider selection, signaling claims/events, reciprocal proof, results, query, and teardown. Safe registration replay rotates raw provision capabilities without replacing the durable operation. Malformed fixed authority, role-mismatched evidence, cross-tenant signaling claims, wrong durable tenant/adapter records, and stale fingerprints fail before the protected access. Two single-worker Chromium scenarios independently prove reciprocal audio/video and matching SSRC evidence across two contexts, third-participant denial, credential containment, accessibility, mobile/ reduced-motion behavior, and ordered teardown. The supervised real MediaMTX/PostgreSQL/SoftHSM/FFmpeg/Chromium gate exercises the reconstructed Aphrodite wrapper through registration replay and capability rotation, invitation exchange, exact signaling, reciprocal proof, restart replay, durable SDP/ICE/raw-secret non-disclosure, forced-RLS sibling denial, lease recovery and stale fencing, and repeat-safe release while retaining the wider protected-media assertions.
• Increment 8u gates pass all 318 shared live-media tests, 196 passing Aphrodite adapter tests with one intentional skip, 6 Aphrodite remote-guest compatibility tests, 108 passing Aphrodite Streaming tests with one intentional real-edge skip, 86 Broadcaster tests, 86 Veritas channel tests, and all 14 V10 Phase A/consolidation tests. Eight strict shared, adapter, Streaming, Broadcaster, Veritas, and Phase A source/spec/consumer typechecks; graph-aware lint for all seven affected and guard projects; dependency- inclusive shared (+6), adapter (+13), remote-guest compatibility (+7), Streaming (+14), and Broadcaster (+16) builds; formatting/diff checks; the two focused browser scenarios; and the supervised real container/media/browser gate pass.
• Increment 8u establishes reusable remote-guest lifecycle and signaling authority, not deployed Veritas/V3/Rail remote-guest providers, durable stores, publisher-grant integrations, signaling gateways, or browser/native runtimes. Its multi-tenant evidence uses in-process providers; the real gates remain Aphrodite tenant #1. SFU/MCU, TURN availability, multi-node signaling, ready non-Aphrodite HLS/DASH, playback grants, decoded Rail playback, final tenant equivalence, and the first-party-live flip remain open.
• Increment 8v moves protected-browser-player registration, compatible descriptor/client admission, privacy-bounded render-evidence observation, synchronous provider execution, and repeat-safe release behind the canonical LiveMediaTenantImmersiveSessionControl. The control validates and fixes one tenant, immersive adapter, and service principal at construction. It reparses the succeeded player record/request and canonical player fingerprint; binds its exact tenant, stream, viewer session, grant/operation, publication, browser client, and unexpired lifecycle; rejects non-browser immersive runtimes or descriptors outside the measured client capabilities; owns the compatible canonical immersive fingerprint and readiness scope; and reparses every reserved, staged, succeeded, and released record. Render evidence must match the registered runtime, projection, field of view, stereo layout, source geometry, and audio format before queue mutation. Provider results and teardown responses must name the fixed tenant/resource, adapter, kind, and operation before the matching durable terminal record is accepted.
• AphroditeImmersiveSessionControl is now a thin tenant-#1 wrapper fixing aphrodite.immersive.v1 and the aphrodite-immersive-session-service principal after caller options are spread. It retains its public constructor and operation alias, exact Aphrodite error class/codes, forced-RLS PostgreSQL player and immersive stores, database-clock lifecycle, leasing/fencing provider, flat/cardboard/WebXR references, Viewer composition/routes, and timing/request-ID seams. The legacy aphroditeImmersiveSessionFingerprint delegates to the shared canonical implementation. An adversarial compatibility case proves runtime-only tenant, adapter, principal, parser, descriptor, and error-factory overrides cannot weaken the wrapper while wrong-operation and released-registration errors retain product identity.
• Three direct canonical tests drive one real LiveMediaOptionalAdapterService with independent in-process Veritas and V3 Stage immersive providers and tenant queue views over one record map. Equal stream, publication, viewer session, grant/operation, client, evidence, and request identities remain isolated in protected-player lookup, queue keys, fingerprints, service scopes, binding verification, provider selection, proof, result, and teardown. Malformed fixed IDs, cross-tenant and stale-fingerprint player records, unsupported native runtimes, incompatible capabilities, mismatched render evidence, wrong durable adapters, and stale immersive fingerprints fail before queue mutation, execution, or teardown. Two single-worker Chromium cases independently prove real 360-degree HLS device-orientation and 180-degree DASH pointer rendering, privacy-bounded proof, accessibility, mobile/reduced-motion behavior, credential containment, and ordered release. The supervised MediaMTX/PostgreSQL/SoftHSM/FFmpeg/Chromium gate exercises the reconstructed Aphrodite wrapper from the exact succeeded protected player through registration, bounded render/audio/orientation evidence, provider proof, restart replay, recovery and stale fencing, forced-RLS sibling denial, and release while retaining the wider protected-media assertions.
• Increment 8v gates pass all 321 shared live-media tests, 197 passing Aphrodite adapter tests with one intentional skip, the complete Aphrodite Viewer test target, 108 passing Aphrodite Streaming tests with one intentional real-edge skip, 86 Veritas channel tests, and all 14 V10 Phase A/consolidation tests. Eight strict shared, adapter, Viewer, Streaming, Veritas, and Phase A source/spec/consumer typechecks; graph-aware lint for all six affected/guard projects; dependency-inclusive shared (+6), adapter (+13), and Streaming (+14) builds; the direct Viewer production build; formatting/diff checks; the two focused browser scenarios; and the supervised real container, media, and browser gate pass.
• Increment 8v establishes reusable immersive lifecycle authority, not deployed Veritas/V3/Rail immersive providers, durable stores, protected-player integrations, or client runtimes. Its multi-tenant evidence uses in-process providers and its real gates remain Aphrodite tenant #1. Native OpenXR/ visionOS and real-headset WebXR conformance, ready non-Aphrodite HLS/DASH, playback grants, decoded Rail playback, final tenant equivalence, and the first-party-live flip remain open.
• Increment 8w moves exact browser-publisher composition registration, bounded render-evidence admission, synchronous provider execution, query, publisher-cascade release, and repeat-safe direct release behind the canonical LiveMediaTenantCompositionControl. The control validates and fixes one tenant, composition adapter, publisher-client adapter, and service principal at construction. It reparses the succeeded publisher record/request and canonical publisher fingerprint; binds its exact tenant, stream, grant/operation, adapter, browser/WebRTC client, and unexpired lifecycle; owns the compatible one-to-four-source browser registration schema, canonical composition fingerprint, and operate scope; and reparses every reserved, staged, queried, publisher-selected, succeeded, and released record. Render evidence must match the registered composition, client, runtime, layout, ordered sources, and output before queue mutation. Provider results and teardown responses must name the fixed tenant/resource, adapter, kind, operation, and provider reference before the matching durable terminal record is accepted.
• AphroditeCompositionControl is now a thin tenant-#1 wrapper fixing aphrodite.composition.v1, aphrodite.publisher-client.v1, and the aphrodite-composition-service principal after caller options are spread. It retains its public constructor, registration schema/type exports, exact Aphrodite error class/codes, forced-RLS PostgreSQL composition and publisher stores, independent positive-ingress edge join, database-clock lifecycle, leasing/fencing provider, Broadcaster composition/routes, timing/request-ID seams, and Canvas/Web Audio runtime. The legacy aphroditeCompositionFingerprint delegates to the shared canonical implementation. An adversarial compatibility case proves runtime-only tenant, composition/publisher adapters, principal, parser, descriptor, and error-factory overrides cannot weaken the wrapper while released-registration replay retains product error identity.
• Three direct canonical tests drive one real LiveMediaOptionalAdapterService with independent in-process Veritas and V3 Stage composition providers and tenant queue views over one record map. Equal stream, publisher grant, operation/composition, client, evidence, and request identities remain isolated in publisher lookup, queue keys, fingerprints, service scopes, binding verification, provider selection, proof, result, query, and teardown. Malformed fixed IDs, cross-tenant and stale-fingerprint publisher records, inactive or expired publishers, mismatched render evidence, wrong durable adapters, stale composition fingerprints, and wrong provider or teardown identities fail before protected queue mutation, execution, or durable acceptance. Three single-worker Chromium cases independently prove real two-source Canvas composition, Web Audio mixing, WHIP publication, positive MediaMTX ingress, privacy-bounded evidence, accessibility, mobile/reduced- motion behavior, authorization denial, and ownership-correct teardown. The supervised MediaMTX/PostgreSQL/SoftHSM/FFmpeg/Chromium gate exercises the reconstructed Aphrodite wrapper from the exact succeeded browser publisher through registration, independently joined edge proof, render/audio evidence, provider result, restart replay, abandoned-lease recovery, stale fencing, forced-RLS sibling denial, and repeat-safe release while retaining the wider protected-media assertions.
• Increment 8w gates pass all 324 shared live-media tests, 198 passing Aphrodite adapter tests with one intentional skip, the complete Aphrodite Broadcaster and Streaming test targets, 86 Veritas channel tests, and all 14 V10 Phase A/consolidation tests. Eight strict shared, adapter, Broadcaster, Streaming, Veritas, and Phase A source/spec/consumer typechecks; graph-aware lint for all six affected/guard projects; dependency-inclusive shared (+6), adapter (+13), Streaming (+14), and Broadcaster (+16) builds; formatting/diff checks; the three focused browser scenarios; and the supervised real container, media, and browser gate pass.
• Increment 8w establishes reusable browser-composition lifecycle authority, not deployed Veritas/V3/Rail composition providers, durable stores, publisher integrations, or client runtimes. Its multi-tenant evidence uses in-process providers and its real gates remain Aphrodite tenant #1. Custom layouts, transitions/switching, GPU/OBS/native or distributed mixing, ready non-Aphrodite HLS/DASH, playback grants, decoded Rail playback, final tenant equivalence, and the first-party-live flip remain open.
• Increment 8x moves product-supplied entitlement-to-viewer-lease-to-playback- grant orchestration, authenticated heartbeat/leave/immersive mutations, optional player/immersive lifecycle sequencing, exact presence projection, and compensating joined-lease cleanup behind the canonical LiveMediaTenantProtectedPlaybackControl. The control validates and fixes one tenant, player adapter, immersive adapter, and identity-denial result at construction. It parses bounded join inputs and generic product entitlement decisions; validates the exact tenant, stream, subject, decision, timestamps, idempotency key, client, active status, lease token, and presence resource returned by viewer-session authority; and validates exact tenant, stream, publication, subject, session, lifetime ordering, and requested-protocol availability on each issued playback grant before optional client access. Player and immersive descriptors must retain fixed adapter, equal grant and operation identities, compatible runtime/protocol or render geometry, and transition-correct status. Authenticated heartbeats, terminal leaves, and presence cannot return a sibling resource. Grant or optional-lifecycle failure after a valid join triggers the compatible short-lease compensation.
• AphroditeProtectedPlaybackControl is now a thin tenant-#1 wrapper fixing the aphrodite tenant, aphrodite.player-client.v1 and aphrodite.immersive.v1 adapters, and the compatible identity_or_stream_not_found identity denial. It retains its positional constructor; public result, input, mutation, and lifecycle types; all seven issue/session/immersive/presence methods; exact product entitlement reasons and SQL policy; external-user-to-viewer principal resolver; shared-backed viewer-session and playback-grant controls; optional player and immersive providers; Viewer routes/runtime; and Streaming real-edge composition. An adversarial compatibility case proves the positional wrapper rejects a sibling-tenant grant or player adapter before client access and still invokes the exact compensating viewer leave.
• Three direct canonical tests compose independent Veritas and V3 Stage entitlement policies, principal resolvers, viewer-session authorities, playback issuers, and player/immersive lifecycle ports with equal user, stream, publication, decision, session, grant, QoE, and render-evidence identities. They prove isolated issue, heartbeat, immersive registration and evidence, leave, lifecycle release, and presence results. Malformed entitlement time bounds, cross-tenant session/grant authority, wrong player or immersive adapters, missing principals, mismatched heartbeat/presence, downstream-access ordering, compensation, and unconfigured immersive lifecycles fail closed. The real gate separately exercises the wrapper with its production-shaped SQL, canonical controls, optional providers, and media path.
• Increment 8x gates pass all 327 shared live-media tests, 199 passing Aphrodite adapter tests with one intentional skip, the complete Aphrodite Viewer target, 108 passing Aphrodite Streaming tests with one intentional real-edge skip, 86 Veritas channel tests, and all 14 V10 Phase A/ consolidation tests. Strict shared, adapter, Viewer, Streaming, Veritas, and Phase A source/spec/consumer typechecks; graph-aware lint for all six affected and guard projects; dependency-inclusive shared (+6), adapter (+13), and Streaming (+14) builds; the direct Viewer production build; formatting/diff checks; 12 single-worker Chromium HLS/DASH player and immersive scenarios; and the supervised real container/media/browser gate pass. The real gate traverses SQL entitlement, the exact leased viewer session and protected grant, player registration and decoded QoE, immersive registration and render evidence, restart/recovery and forced-RLS isolation, and final release through the reconstructed Aphrodite wrapper while retaining the wider protected-media assertions.
• Increment 8x establishes reusable protected-playback orchestration, not shared product entitlement or identity policy and not deployed Veritas/V3/Rail policies, issuers, sessions, stores, providers, or client runtimes. Its direct multi-tenant evidence uses in-process ports and its real gate remains Aphrodite tenant #1. Ready non-Aphrodite HLS/DASH, playback grants, decoded Rail playback, final tenant equivalence, and the first-party-live flip remain open.
• Increment 8y resolves a cross-tenant edge-identity gap found while following the Veritas rehearsal seam toward a real provider. The durable shared stores consistently key authority by tenant and stream UUID, but the MediaMTX path adapter formerly accepted only a bare UUID and supplied its tenant from constructor configuration. Two tenants using the same valid stream UUID would therefore name the same edge path before SQL isolation could help. The canonical root contract now owns a versioned live-media.v1/<tenant>/<stream UUID> codec with strict parse and tenant-boundary resolution. MediaMtxEdgeProvider uses canonical paths by default, ignores unmanaged and sibling-tenant paths, and treats malformed paths inside its owned namespace as provider-protocol failure rather than guessing. Bare UUID discovery is available only through the explicit legacy-stream-id mode.
• Aphrodite's current production, pipeline, browser-test-server, and real-edge provider compositions select legacy-stream-id explicitly, preserving tenant #1 behavior while its MediaMTX publisher URLs remain bare UUIDs. Its external authentication and publish-lifecycle callback schemas dual-read an exact canonical Aphrodite resource path and the legacy UUID, normalize both to the same stream authority, and reject a canonical Veritas path carrying the same UUID before grant lookup or publisher-edge mutation. This is a bounded migration seam, not a claim that the deployed Aphrodite edge has switched path formats.
• The Veritas production-test stream, ingest request, and receipt contracts are versioned to .2. A product schedule source such as synthetic-bars-1 is no longer misrepresented as a shared stream ID: the stream spec carries a separate UUID resource identity, the request derives the exact veritas resource and canonical media path, and the receipt must return both bindings. The receipt also supplies a validated publication UUID, and its ordered HLS and DASH URLs must resolve to the exact canonical publication object prefix; an arbitrary test-host manifest with a plausible suffix is insufficient. Rehearsal admission rechecks program/source/resource/path/byte/time authority before returning the still-unpublishable result.
• Adversarial tests prove canonical codec round-trip, rejection of implicit legacy and malformed owned paths, explicit legacy compatibility, equal stream UUID sibling filtering in MediaMTX discovery, and Aphrodite rejection of a canonical sibling tenant before state mutation. Veritas tests reject malformed resource IDs, cross-tenant/resource/media-path receipts, publication IDs whose URLs retain another publication prefix, and protocol/host/credential/query/ path substitutions. All 328 shared live-media tests, 108 passing Aphrodite Streaming tests with one intentional real-edge skip, 92 Veritas channel tests, and all 14 V10 Phase A/consolidation tests pass. Shared source and spec, Streaming, and Veritas typechecks; graph-aware lint for all three affected projects; dependency-inclusive shared (+6) and Streaming (+14) builds; formatting/diff and adversarial stub scans; and the supervised digest-pinned MediaMTX/PostgreSQL/SoftHSM/FFmpeg/Chromium test also pass. The supervised gate retains real ingest, protected playback, lifecycle, persistence, fencing, isolation, and teardown coverage through Aphrodite's explicit legacy mode.
• Increment 8y establishes collision-free edge naming and exact Veritas rehearsal identity contracts. It does not deploy a Veritas, V3 Stage, or Rail MediaMTX publisher; create their ready HLS/DASH publications or playback grants; decode Veritas media in the Rail; finish tenant equivalence; migrate Aphrodite publishers to canonical paths; or flip first-party-live.
• Increment 8z moves the durable job-to-transcode-to-package-to-publish worker assembly behind the server-only createLiveMediaPipelineRuntime boundary. A product host now supplies a fixed tenant, durable job and publication stores, execution/packaging/object-store adapters, and worker configuration; shared code alone constructs the job service, transcode execution service, publication service, attempt executor, and fenced worker. Tenant authority is parsed once and applied after caller worker options. Aphrodite's production pipeline and both real-gate process compositions use this factory while retaining Aphrodite controls and deployment adapters.
• Direct shared tests execute the same factory for Aphrodite, Veritas, and V3 Stage over shared in-memory stores, using the same stream UUID and idempotency key. Each tenant reaches its own ready HLS/DASH publication and canonical immutable object prefix. An adversarial caller cannot replace the fixed Veritas tenant through worker options, and a relative server output root fails construction.
• The supervised real gate publishes that same stream UUID simultaneously on Aphrodite's explicit legacy path and Veritas's canonical live-media.v1/veritas/<stream UUID> path. Independent MediaMTX providers see only their configured tenant, the canonical Veritas HLS edge output decodes, and the shared SQL registry durably binds the Veritas resource. Shared SQL job/publication stores and the generic runtime then read the live canonical RTSP source, run the real Neith/FFmpeg H.264/AAC transcode, create and publish HLS plus DASH, persist a ready publication under the Veritas tenant, and independently ffprobe both stored manifests for decoded audio, video, dimensions, and positive duration.
• Increment 8z gates pass all 330 shared live-media tests, 108 passing Aphrodite Streaming tests with one intentional real-edge skip, 92 Veritas channel tests, and all 14 Phase A/consolidation tests. Strict source/spec and consumer typechecks, graph-aware lint, dependency-inclusive shared and Streaming builds, formatting/diff checks, and the supervised real MediaMTX/PostgreSQL/SoftHSM/FFmpeg/Chromium gate pass.
• This proves one reusable production-shaped pipeline assembly and a real canonical Veritas ingest-to-ready-media path. It does not yet connect the Veritas rehearsal byte port to this runtime, deploy durable Veritas publisher grants, issue Veritas viewer/playback authority, decode the result in Rail, compose V3 Stage production runtime, migrate Aphrodite publishing to canonical paths, complete tenant equivalence, or flip first-party-live.
• Increment 8aa connects the audited Veritas rehearsal byte port to that shared runtime without widening it into a product upload API. The root contract now defines a strict test MPEG-TS request/result and a 64-MiB ceiling. The server-only LiveMediaTestIngestRuntime fixes one tenant, admits only one-MiB-or-smaller non-empty chunks, writes a create-only temporary object, verifies exact declared length and SHA-256, fsyncs it, and retains one read-only content-addressed input under the canonical tenant/stream directory. Replays verify that immutable object and reuse the durable job and publication. Construction rejects a relative input root or pipeline-tenant mismatch; request tenant mismatch fails before consuming bytes; partial or corrupt input is removed; and a non-isolated tenant queue fails explicitly instead of returning another job's result.
• VeritasProductionSharedMediaTestIngest is a thin tenant-#2 adapter over that port. It reparses the exact v2 rehearsal request, binds the canonical Veritas resource and edge path, derives a deterministic job idempotency key, fixes a bounded H.264/AAC 360p rendition, and accepts only exact ready HLS/DASH object keys beneath a credential-free HTTPS .test or localhost origin. The existing rehearsal pipeline consumes the adapter unchanged and returns a deep-frozen v2 receipt while HG-3 and first-party-live remain closed.
• The supervised real-media gate now also generates a two-second MPEG-TS test pattern with FFmpeg, streams those actual bytes through the production rehearsal pipeline and shared SQL-backed Veritas job/publication runtime, runs the real Neith/FFmpeg transcode and HLS/DASH publication path, then independently ffprobes both durable manifests for H.264/AAC, 640x360 video, and positive duration. The simultaneous canonical Veritas RTSP publisher coverage from increment 8z remains in the same gate.
• Increment 8aa gates pass all 332 shared live-media tests, 108 passing Aphrodite Streaming tests with one intentional real-edge skip, 94 Veritas channel tests, and all 14 Phase A/consolidation tests. Strict shared, Streaming, and Veritas typechecks; graph-aware lint for those projects and Phase A; dependency-inclusive shared and Streaming builds; a frozen-lockfile filtered install; formatting/diff and source-stub checks; and the supervised real MediaMTX/PostgreSQL/SoftHSM/FFmpeg/Chromium gate pass.
• This closes only the rehearsal-to-runtime byte wiring. The bridge is synchronous and test-only and requires an isolated tenant queue. A deployed long-running Veritas ingest/scheduler and durable publisher-grant service, Veritas viewer session and playback grants, decoded Rail playback, V3 Stage production composition, Aphrodite canonical-path migration, final tenant equivalence, and the first-party-live flip remain open.
• Increment 8ab exposes the injected LiveMediaTenantPublisherGrantControl contract from the canonical root while keeping its credential service and SQL stores server-only. VeritasProductionPublisherGrantControl is the tenant-#2 product composition: it fixes tenant veritas, owner product veritas, and external identity v1.veritas-live after spreading caller options. Product callers can therefore provide only an authenticated principal and stream UUID; create/manage scopes, exact resource construction, registry registration, and grant issue, authenticate, rotate, and revoke delegation stay canonical.
• Direct Veritas tests exercise every operation and exact scope/resource/mapping projection. An adversarial caller that casts forbidden tenant, owner, or external-mapping options cannot widen the control, and malformed stream identity fails before registration or grant issuance.
• The supervised real-media gate no longer creates the Veritas credential in a memory store. It issues through the product control into the shared forced-RLS PostgreSQL resource registry and publisher-grant store, reconstructs the control and SQL store before use, rejects an unknown valid-shaped secret, and lets MediaMTX authenticate a real FFmpeg SRT publisher only on the canonical live-media.v1/veritas/<stream UUID> path. The resulting edge HLS decodes as H.264 at the declared dimensions and continues into the existing real Veritas transcode/publication and rehearsal gates. After the database client is reconstructed, a newly composed Veritas control authenticates the same persisted grant and exact resource.
• Increment 8ab gates pass all 332 shared live-media tests, 108 passing Aphrodite Streaming tests with one intentional real-edge skip, 96 Veritas channel tests, and all 14 V10 Phase A/consolidation tests. Strict shared, Streaming, Veritas, and Phase A typechecks; graph-aware lint; dependency- inclusive shared and Streaming builds; a frozen-lockfile filtered install; formatting/diff checks; and the supervised real MediaMTX/PostgreSQL/SoftHSM/FFmpeg/Chromium gate pass.
• This closes durable Veritas publisher-grant composition and real canonical edge authentication at the code and local release-gate boundary. A deployed long-running Veritas publisher/scheduler host, viewer-session and playback grants, decoded Rail playback, V3 Stage production composition, Aphrodite canonical-path migration, final tenant equivalence, HG-3, and the first-party-live flip remain open.
• Increment 8ac adds the matching Veritas tenant-fixed viewer-session, playback-grant, and protected-playback controls. Fixed tenant, service principals, veritas.player-client.v1, veritas.immersive.v1, and bounded identity denial are applied after every injected option; direct hostile-option tests and the real gate exercise the resulting authority without creating a V10-owned media stack.
• The Rail's FirstPartyLiveVideoGate can now be constructed with one explicit shared-media authority for the exact HLS/DASH set while its exported default remains fail-closed. Channel registration, lane admission, and the web panel share that status. The panel mounts only the canonical surface from the narrow @oshun/live-media/browser/player entry and requires the playback resolver's authority ID plus returned tenant, stream, protocol, API base, and manifest to match the selected source exactly, without bringing server-only controls or unrelated browser adapters into the Rail boundary.
• The supervised real-media gate carries generated MPEG-TS rehearsal bytes through the Veritas product pipeline into a durable SQL publication, issues a signed viewer-bound grant through the Veritas composition, and drives the actual Rail panel in Playwright-controlled Chromium for both HLS and DASH. Success requires explicit start, positive decoded frames, a successful heartbeat, persisted presence/QoE, credential-free DOM, no unexpected browser/media failures, lane release, zero presence, and immediate VIEWER_SESSION_INACTIVE denial for the former token. Browser cancellation of an obsolete adaptive segment is bounded to the exact issued publication directory and is not treated as an origin failure.
• This closes a local product-composed Veritas ingest-to-decoded-Rail slice, not a deployment. The real gate's player lifecycle is intentionally in-memory; the default Rail composition is still closed, and no durable Veritas player adapter, playback-route host, long-running scheduler, V3 composition, Aphrodite canonical migration, final tenant-equivalence result, HG-3, or production first-party-live flip is claimed. The RB.3 parent and equivalence test checkboxes therefore remain open.
• Increment 8ad removes Aphrodite's production legacy-stream-id edge mode. Broadcaster WHIP and native-SRT provisioning expose one exact canonical live-media.v1/aphrodite/<stream UUID> path; browser authorization is fenced to the full tenant/resource WHIP suffix, and the TypeScript/Rust native bridge validates and sends that path without putting credentials on argv. Production reconciliation, lifecycle hooks, pipeline recording authority, and RTSP source resolution now use the same namespace. The distinct legacy RTMP and lifecycle callback body shapes remain compatibility inputs, while a bare UUID MediaMTX path fails before durable grant lookup.
• Unit and browser adversarial coverage rejects bare paths, equal-UUID sibling tenants, mismatched native paths, and escaped WHIP sessions. The supervised MediaMTX gate additionally rejects a valid Aphrodite grant presented on a bare SRT path, then carries Aphrodite and equal-UUID Veritas publishers through canonical tenant-qualified SRT/WHIP, HLS, RTSP recording/transcode, protected playback, and teardown on the same edge. Affected shared, Aphrodite adapter, Streaming, and Broadcaster tests; four strict typechecks and lints; the Rust native publisher tests/build; dependency-inclusive builds; the 19-scenario single-worker Chromium gate; formatting/diff checks; and the supervised real gate pass.
• This completes Aphrodite's canonical edge-path migration at the code and local release-gate boundary. It does not claim a deployed scheduler, durable Veritas player host, V3 Stage production composition, final tenant equivalence, HG-3, or the production first-party-live flip. RB.3 and its equivalence-test checkbox remain open.
• Increment 8ae adds V3 Stage's tenant-#3 production authority composition in @oshun/v10-rail-channel-stage. The product wrappers fix tenant v3-stage, pipeline/viewer/playback service principals, publisher owner and v3.stage:<stream UUID> external-resource mapping, v3-stage.player-client.v1, v3-stage.immersive.v1, and bounded identity denial after all injected options. Equal stream, job, publication, entitlement, and viewer-session identities remain isolated from a sibling Veritas composition through real shared controls; hostile tenant, principal, product, mapper, adapter, and denial options cannot weaken Stage authority.
• The complete Stage unit suite, strict typecheck, lint, dependency-inclusive build, Streaming regression checks, frozen-lockfile validation, formatting/ diff checks, and supervised real PostgreSQL/MediaMTX gate pass. The real gate persists the equal stream UUID for V3 Stage and Veritas, resolves the exact Stage product mapping, authenticates only the Stage grant in its tenant, and proves reciprocal secret denial before revocation. This closes the missing V3 Stage tenant-fixed shared-media control composition at the code boundary. It does not create a rendered Stage artifact or catalog row, bind the existing cook to an Unreal renderer or durable catalog, or deploy a long-running scheduler, publisher, or playback host. Final tenant equivalence and the production first-party-live flip remain open.
• Increment 8af supplies the missing Stage cook-to-immutable-delivery boundary without creating a second media stack. The shared media-object MIME schema is narrowly extended for progressive WebM, paired MP4/MP3/Ogg audio, and JPEG/PNG/WebP/AVIF artwork, while the canonical root exposes only the create-only object-store port type. V3StageImmutableDeliveryAdapter fixes keys under live-media.v1/v3-stage/catalog/v1, applies role-specific byte ceilings and immutable caching, and treats only an exact stored object as an idempotent replay. It rechecks storage, then fetches the credential-free exact HTTPS object with redirects disabled and requires matching HTTP status, content type, length, and SHA-256 before a catalog receipt can become usable. FfprobeStageStoredMediaProbe writes only to a private transient directory, invokes ffprobe without a shell, and requires a positive-duration decoded video/audio stream or positive artwork dimensions before returning.
• Adversarial tests cover origin credentials, object-path escape, changed bytes at one immutable key, role/MIME substitution, and exact replay. A full cook contract test binds all three roles. The Streaming release gate generates real H.264/AAC MP4, AAC M4A, and PNG bytes with FFmpeg, persists them through the canonical local create-only store, retrieves their exact origin bytes, decodes all three with real ffprobe, and publishes only to an in-memory test catalog. This closes immutable storage and delivery verification, not a V3 render: no recorded V3 candidate, Unreal render, production catalog row, durable catalog writer, scheduler/publisher/player host, final tenant equivalence, or first-party-live flip is claimed.
• Increment 8ag supplies the missing authoritative V3 release-evidence adapter for the Stage cook through the dedicated @oshun/v10-rail-channel-stage/release entry point, keeping its V3 authoring/export dependencies out of the browser-facing channel root. V3StageRecordedReleaseGateAdapter consumes the actual Saraswati authoring-editor and V3 concert-export types through an injected repository, then fixes the returned bundle to the exact Stage item, version, and concert. Recorded readiness requires every authoring gate, the published Sequencer receipt, full provenance attachment, and GA cadence to agree. A ready export must be fresh and retain a unique canonical proof plus matching proof verdict for every non-human gate; wrong subject/type, duplicate, detached, expired, future, stale, or contradictory evidence fails closed. Suites that name human signoff additionally require the exact fresh promotion and its canonical human_approval proof, bound to the artifact, content hash, signer, decision, and evidence. Declared drills always project as blocked.
• Contract coverage uses the real recorded Saraswati editor-state builder and exercises exact mapping, drill denial, item/version/concert substitution, stale export reports, proof substitution, missing/hostile human promotion, and forged ready authoring state. This closes the release port, not its deployment: no durable candidate repository, Calliope-plan projection, Unreal renderer, production catalog row/writer, scheduler/publisher/player host, final tenant equivalence, or first-party-live flip is claimed.
• Increment 8ah supplies the durable V3/Calliope cook source without turning either system's design state into playable media. The canonical OSHUN PostgreSQL schema now carries immutable candidate revisions with an exact projection SHA-256 and a partial unique index admitting only one current ready version. SqlV3StageCookCandidateRepository transactionally publishes increasing versions, accepts only an exact idempotent replay, supersedes the prior row, makes withdrawal terminal for that version, bounds cook reads, and rejects changed hashes or indexed/payload identity disagreement.
• The projection reuses the owning V3 and Calliope schemas. It requires a recording-authorized concert; one exact V3 persona, setlist, duration, and track inventory; a bijective title-preserving Calliope-slot/V3-track join; matching Calliope artist/concept/setlist/camera/venue identities; and a programming anchor present in the selected setlist, camera plan, and VOD package. Energy, section, and perspective derive from those real plan values; numeric cut density requires a separately cited editorial measurement because Calliope expresses cadence only as prose. Unit/adversarial coverage and a disposable real-PostgreSQL migration/restart/supersession/withdrawal gate pass. This closes the durable candidate and Calliope projection code boundary, not content deployment: no candidate row, Unreal render, durable catalog row, scheduler/publisher/player host, final equivalence, or first-party-live flip is claimed.
• Increment 8ai supplies the durable rendered-catalog writer and playback reader over the canonical OSHUN PostgreSQL client. Migration 20260721230000_v10_stage_rendered_catalog stores immutable versioned Stage items, their canonical SHA-256, indexed artist/concert identity, publication time, and explicit retirement evidence. Database constraints, an update trigger, and a partial unique index freeze item identity/JSON, permit only an active-to-superseded/withdrawn transition, and admit only one active revision per item.
• SqlV3StageRenderedCatalogRepository transactionally publishes monotonically increasing versions, accepts only an exact active replay, supersedes the previous row, and treats withdrawal as terminal. Bounded due-item reads admit active rows only, rebind all indexed identities, recompute the canonical item hash, reject duplicate active ids, and clone validated payloads. Focused adversarial tests and a disposable full-migration PostgreSQL gate prove restart reads, direct hash/identity mutation rejection, concurrent exact retries, supersession, withdrawal, and resurrection denial. This closes the durable catalog code boundary only: no row is seeded and no Unreal render, rendered artifact, deployed host, final equivalence, or first-party-live flip is claimed.
• Increment 8aj supplies the fail-closed V3 Stage Unreal render boundary and a real local UE5.5 release gate. V3/ue/StageRenderWorker is a minimal headless editor project whose strict Python commandlet loads one persisted /Game level and the exact published LevelSequence, resolves exactly one named CineCameraActor, verifies that the sequence possesses that exact camera class/name, evaluates a bounded frame range, and emits contiguous PNGs plus a SHA-256 manifest. Its tiny native module finishes asynchronous assets, submits the loaded world's material shaders, waits for shader completion, and flushes rendering commands before capture and shutdown. This rejects the earlier black-frame/shader-cancellation failure instead of treating emitted files as success.
• The server-only V3StageUnrealRenderer rebinds the durable candidate/version, concert, export hash, and Sequencer receipt to a strict injected V3 binding; launches Unreal without a shell under bounded process-group supervision and a safe environment allowlist; and independently validates the exact manifest, file set, contiguous indices, PNG signatures/dimensions, byte sizes, SHA-256 values, and observable frame variation. It rejects symbolic-link aliases and undeclared files, enforces configured pixel-frame and scratch-capacity budgets, copies the exact digest-authorized audio bytes into the private job, runs real FFmpeg H.264/AAC encoding, and requires FFprobe to observe one exact video/audio stream set, geometry, rate, frame count, and duration. Every outcome removes the transient job.
• Sixteen focused tests cover exact success, release/binding substitution, manifest identity/hash/geometry forgery, static frames, undeclared output, changed or symlinked audio, forged FFprobe frame/duration evidence, nonzero Unreal exit, resource exhaustion, and cross-user ownership. The complete Stage suite passes 79 tests with three environment-gated tests skipped; strict typecheck and lint pass. The explicit on-box gate builds the editor module, authors an isolated two-second engine-primitive fixture, renders 24 distinct 640x360 RGBA PNGs through UE5.5/Lavapipe with exit 0, and then passes the complete server adapter through real FFmpeg/FFprobe in 12.79 seconds. The fixture is test-only and no candidate, binding, media object, or catalog row is seeded. A production V3 binding repository/row, real first-party performance render, deployed worker, final tenant equivalence, and first-party-live flip remain open.
• The RB.3 consolidation guard is now complete in the existing V10 Phase A invariant project. Its real-workspace scan covers both V10 ownership roots, ignores generated directories and symlinks, and rejects a new live-media/streaming/ingest/transcode package, direct Aphrodite/Neith media control, the Kafka-shaped @oshun/streaming package, direct HLS/DASH/WebRTC browser engines, canonical server/private subpaths, relative-path bypasses, and native FFmpeg/GStreamer/WebRTC/SRT crates. Package manifests and static, re-exported, import-equals, type, require, dynamic, renamed, target-specific, and Cargo table dependencies have adversarial fixtures. Only the canonical @oshun/live-media contract and browser/native client subpaths are admitted. Six focused guard cases, all fourteen Phase A tests, strict typecheck, and lint pass. This closes the guard only; it does not claim tenant equivalence or an ingest-to-Rail flow.
• Increment 8ak closes the final local four-tenant equivalence and supervised ingest-to-Rail test requirement without changing the canonical substrate. apps/oshun/bff/src/v10/rail-live-media-controls.ts is the Rail server composition boundary: its pipeline, publisher-grant, viewer-session, playback-grant, and protected-playback controls fix tenant v10-rail, exact service principals, v10.rail:<stream UUID> product mapping, v10-rail.player-client.v1, v10-rail.immersive.v1, and the bounded identity_or_source_not_found denial after every injected option. V10-owned client/kernel packages still import no canonical server/private subpath and own no second media stack.
• The focused cross-product suite runs Aphrodite tenant #1, Veritas tenant #2, V3 Stage tenant #3, and Rail tenant #4 against the same shared controls. Equal stream and job UUIDs produce exact tenant-local resources and service scopes; four real in-memory publisher grants authenticate only in their issuing tenant, reciprocal secret use fails closed, Rail revocation leaves the other three active, and leased viewer presence plus teardown remains isolated while a sibling lease is rejected. This product-composition evidence complements the existing forced-RLS four-tenant PostgreSQL gate rather than replacing it.
• Release evidence is green for 333 shared live-media tests, 199 Aphrodite adapter tests (one environment-gated case skipped), 79 Stage tests (three environment-gated cases skipped), 98 Veritas tests, all 21 Phase A tests, and four new BFF equivalence tests. The focused strict TypeScript configuration, targeted ESLint, Prettier, BFF production build, and dependency/lock importer checks pass. The separately enabled supervised PostgreSQL/MediaMTX/SoftHSM/FFmpeg/Chromium gate also passes: generated Veritas MPEG-TS becomes durable HLS/DASH, the actual Rail panel decodes both protocols, and heartbeat/presence/QoE, secret containment, release, revocation, and teardown are observed. Missing generated shared-database source maps remain Vite diagnostics only.
• This completes the RB.3 automated test checkbox and final local tenant equivalence. It does not seed a first-party Stage candidate or catalog item, deploy long-running tenant schedulers/workers/playback hosts, or flip the exported production first-party-live default. Those implementation and deployment requirements keep the parent extraction checkbox open.
• Increment 8al removes the remaining test-fixture-only composition gap in the Rail web app without declaring an unavailable production program. Deployment may now supply one credential-free NEXT_PUBLIC_RAIL_FIRST_PARTY_LIVE_CONFIG manifest that binds an authority to exact channel/source/tenant/stream, protocol, manifest URL, and same-origin protected-playback API tuples. The actual RailApp constructs both lane admission and the browser player from that one authority; missing configuration retains not_configured, while invalid, cross-origin, credentialed, partial, duplicate, or substituted bindings fail closed. The supervised Veritas ingest-to-Rail Chromium fixture now consumes this production composition rather than constructing its own resolver. The complete V10 web suite passes 188 tests, including new direct adversarial coverage, with strict typecheck and targeted lint. A dedicated Playwright path passes in desktop and mobile Chromium, proving exact lane admission, rendered authority identity, zero autoplay, and release cleanup; it mocks the player dependency and therefore makes no decoded-media claim. The Phase A ownership/consolidation suite also remains green. The production Next/static-PWA build passes with 37 revisioned assets, and the freshly rerun supervised PostgreSQL/MediaMTX/SoftHSM/FFmpeg/Chromium gate carries real Veritas test ingest through this composition to decoded Rail HLS/DASH with teardown (one test, 45.53 seconds); only the previously documented missing generated source-map diagnostics remain. This closes deploy-time client composition only. It does not seed content, install the same-origin server host, retain a production media receipt, or make an unconfigured deployment live; those requirements keep the parent open.

Audit conclusion#

The useful reusable surface is fragmented rather than absent: Aphrodite has substantial product behavior, SQL-backed service boundaries, browser media utilities, crypto/container primitives, and many tests; shared storage/cache/ events already exist; Neith has real codec and transport kernels. What does not yet exist is the complete durable, multi-tenant live-broadcast composition that connects this now-real ingest, signed manifest, leased viewer session, presence, decoded playback, live chat, and operational hooks/telemetry path to the remaining optional-adapter depths and deployed tenant hosts.

Accordingly, the 17-service/adjacent-library audit, increments 1–6, increment 7a's extension contract, increments 7b–7m's real content-analysis, recording, AES-128 HLS protection, visible-watermark, browser/native HLS/DASH player, browser-WHIP publisher, native-SRT publisher, browser immersive, and browser remote-guest, bounded browser-composition, and protected-HLS viewer/release paths, increment 8a's tenant/resource SQL identity boundary, and increment 8b's tenant-neutral shared client surface plus increment 8c's shared tenant-fixed pipeline control and Veritas tenant-#2 composition, increment 8d's shared durable SQL pipeline store, and increment 8e's shared durable identity and publisher-grant stores plus increment 8f's shared durable publisher-edge and publication stores plus increment 8g's shared durable viewer-session/presence store plus increment 8h's shared durable live-chat store, increment 8i's shared operational telemetry/hook store, increment 8j's tenant-fixed viewer, telemetry, and playback-grant controls, and increment 8k's tenant-fixed publisher-grant and transcode controls plus increment 8l's tenant-fixed publisher-edge control and increment 8m's tenant-fixed media-publication control plus increment 8n's tenant-fixed live-chat control and increment 8o's tenant-fixed content-analysis control plus increment 8p's tenant-fixed recording control and worker and increment 8q's tenant-fixed segment-encryption control and worker plus increment 8r's tenant-fixed visible-watermark control and worker plus increment 8s's tenant-fixed player-client lifecycle control and increment 8t's tenant-fixed publisher-client lifecycle control plus increment 8u's tenant-fixed remote guest lifecycle and signaling control plus increment 8v's tenant-fixed immersive session lifecycle control plus increment 8w's tenant-fixed browser-composition lifecycle control plus increment 8x's tenant-fixed protected-playback orchestration control and increment 8y's canonical tenant/resource edge-path and Veritas rehearsal identity boundary plus increment 8z's shared production pipeline assembly and real Veritas canonical ingest-to-ready-media gate and increment 8aa's bounded Veritas rehearsal-to-runtime byte bridge plus increment 8ab's durable Veritas publisher-grant composition and canonical real-edge authentication plus increment 8ac's tenant-fixed protected-playback composition and actual local Veritas HLS/DASH decode in the Rail plus increment 8ad's Aphrodite canonical edge-path migration plus increment 8ae's V3 Stage tenant-#3 production authority composition plus increment 8af's Stage immutable rendered- delivery boundary plus increment 8ag's recorded V3 release-evidence boundary are complete at their code and local release-gate boundaries. Increment 8ah's durable candidate/Calliope projection, increment 8ai's durable rendered-catalog repository, and increment 8aj's fail-closed Unreal/FFmpeg render boundary and real local UE5.5 release gate are likewise complete at those boundaries. Increment 8ak's four-tenant product-equivalence suite and supervised local ingest-to-Rail gate are complete as well. Increment 8al's exact deployment manifest and real Rail-app composition are complete at the client boundary. The broader increment 7 scopes, remaining deployed tenant hosts, and the parent RB.3 implementation checkbox remain open. The audit does not mark any simulated package as production, conflate direct WebRTC with an SFU/TURN service, conflate HLS encryption with vendor DRM, represent a visible marker as forensic protection, conflate bounded Canvas composition with GPU/OBS/native or distributed mixing, claim a complete desktop/mobile client UI, authorize a second stack, or treat local tenant equivalence as deployed production readiness.