The Rail · Reference & analysis

RD.3 Aphrodite adult-ring integration

HG-6 remains open.

5sections4 minread
Markdown source
On this page

Date: 2026-07-22

Launch boundary#

HG-6 remains open. This increment builds and verifies the channel behind the adult wall; it does not register the channel in the production directory or make it user-visible. Private live and its visual tokens are explicitly marked hg6-pending placeholders. Product naming, policy approval, and launch registration require the human gate and are not represented as complete.

The production-directory unit and browser tests assert that neither the technical channel id nor the placeholder/Aphrodite name is exposed.

Channel and RB.3 binding#

@oshun/v10-rail-channel-aphrodite owns one strict activation boundary for channel v10.aphrodite-content. A live program is admissible only when it:

  • identifies the canonical RB.3 tenant as exactly aphrodite;
  • names one UUID stream and publication in live / ready state;
  • provides HTTPS HLS or DASH delivery through the shared first-party-live lane;
  • declares a bounded set of canonical Aphrodite consent triggers; and
  • is admitted by a configured kernel FirstPartyLiveVideoGate whose authority is exactly v10.aphrodite.rb3-playback.v1.

The web playback authority repeats that tenant, stream, protocol, and manifest binding before the canonical @oshun/live-media/browser/player surface can join a host-supplied same-origin base for Aphrodite's authenticated /streams/:streamId/playback route. The canonical player then rejects any grant that does not echo the exact Aphrodite tenant, stream, protocol, and manifest. There is no second player or streaming implementation. Because HG-6 is open, no production route or directory registration is configured by this increment; the deployer must supply that same-origin route as part of the approved launch composition.

Adult wall and inherited safety gates#

Activation fails closed, without emitting a renderable manifest, unless all of the following are simultaneously true:

  • the exact viewer has an unexpired V1 adult-ring access assertion;
  • the surface is the desktop shell or browser panel;
  • the resolved daypart is private or wind-down;
  • discretion support is present and armed, with no active screen share;
  • the canonical Aphrodite viewer-consent session belongs to the exact viewer, is live and unpaused, has no pending warnings, and includes opt-in for every declared trigger;
  • Aphrodite BodyDignity.checkAll passes the current camera, lighting, effects, and composition frame; and
  • a strict, PII-free aftercare-readiness authority confirms the exact viewer and stream after the live-program observation.

The real manifest is exercised against R0.6/RA.9. It is absent from the default directory and every recommendation surface, excluded from Ori inputs, watch parties, and cross-promotion, rejected on mobile/watch/TV, and limited to the two permitted dayparts.

Protected viewing flow#

The isolated prelaunch web surface reveals no program, stream, trigger, or media detail while activation is held. A ready activation presents the consent boundary but still mounts no media until a fresh Enter private viewing gesture. A new stream/publication resets that gesture. Loss of discretion or any other activation gate synchronously replaces the surface and destroys the protected player.

Exit now is persistent while viewing. It unmounts media before showing a stigma-free settle surface. Support-resource and return-to-Rail affordances are required host actions rather than decorative text.

The restrained near-black, warm-neutral, and single muted-consent-accent visual system follows the mandatory frontend guidance. Desktop and constrained mobile browser renders were inspected; mobile browser coverage validates responsive layout only and does not change the manifest's prohibition on the native mobile surface.

Verification#

Passing focused checks on 2026-07-22:

  • Aphrodite channel contract/activation: 10 tests;
  • complete Phase-A invariant and consolidation suite: 28 tests, including one independently named test for every real-channel wall clause;
  • kernel ring, first-party-live, and discretion suites: 27 tests;
  • affected V10 web component, canonical player, settings, and production directory suites: 19 tests;
  • BFF exact-subject age assertion and adult opt-in routes: 10 tests;
  • Aphrodite Auth assertion/SQL-reader suites: 4 tests;
  • canonical age-verification assertion suite: 2 tests;
  • desktop and mobile Chromium protected-flow plus production-directory checks: 4/4, including axe analysis, no pre-gesture media, immediate discretion collapse, actionable aftercare, and HG-6 non-exposure;
  • strict TypeScript checks for the channel, Phase-A registry, and V10 web;
  • targeted ESLint and Prettier checks; and
  • filtered offline frozen-lockfile installation.

The Auth test run emits existing missing-source-map warnings for generated libs/shared/database/src/*.js.map files; all selected tests pass. A Next production build was not run because the 15 GiB host falls under the repository's explicit small-host prohibition for that broad gate. Targeted TypeScript, Vitest, and two-browser Playwright coverage exercise the affected surface instead.