# RD.3 Aphrodite adult-ring integration

Date: 2026-07-22

## Launch boundary

HG-6 remains open. This increment builds and verifies the channel behind the
adult wall; it does not register the channel in the production directory or make
it user-visible. `Private live` and its visual tokens are explicitly marked
`hg6-pending` placeholders. Product naming, policy approval, and launch
registration require the human gate and are not represented as complete.

The production-directory unit and browser tests assert that neither the
technical channel id nor the placeholder/Aphrodite name is exposed.

## Channel and RB.3 binding

`@oshun/v10-rail-channel-aphrodite` owns one strict activation boundary for
channel `v10.aphrodite-content`. A live program is admissible only when it:

- identifies the canonical RB.3 tenant as exactly `aphrodite`;
- names one UUID stream and publication in `live` / `ready` state;
- provides HTTPS HLS or DASH delivery through the shared `first-party-live`
  lane;
- declares a bounded set of canonical Aphrodite consent triggers; and
- is admitted by a configured kernel `FirstPartyLiveVideoGate` whose authority
  is exactly `v10.aphrodite.rb3-playback.v1`.

The web playback authority repeats that tenant, stream, protocol, and manifest
binding before the canonical `@oshun/live-media/browser/player` surface can join
a host-supplied same-origin base for Aphrodite's authenticated
`/streams/:streamId/playback` route. The canonical player then rejects any grant
that does not echo the exact Aphrodite tenant, stream, protocol, and manifest.
There is no second player or streaming implementation. Because HG-6 is open, no
production route or directory registration is configured by this increment; the
deployer must supply that same-origin route as part of the approved launch
composition.

## Adult wall and inherited safety gates

Activation fails closed, without emitting a renderable manifest, unless all of
the following are simultaneously true:

- the exact viewer has an unexpired V1 adult-ring access assertion;
- the surface is the desktop shell or browser panel;
- the resolved daypart is private or wind-down;
- discretion support is present and armed, with no active screen share;
- the canonical Aphrodite viewer-consent session belongs to the exact viewer, is
  live and unpaused, has no pending warnings, and includes opt-in for every
  declared trigger;
- Aphrodite `BodyDignity.checkAll` passes the current camera, lighting, effects,
  and composition frame; and
- a strict, PII-free aftercare-readiness authority confirms the exact viewer and
  stream after the live-program observation.

The real manifest is exercised against R0.6/RA.9. It is absent from the default
directory and every recommendation surface, excluded from Ori inputs, watch
parties, and cross-promotion, rejected on mobile/watch/TV, and limited to the
two permitted dayparts.

## Protected viewing flow

The isolated prelaunch web surface reveals no program, stream, trigger, or media
detail while activation is held. A ready activation presents the consent
boundary but still mounts no media until a fresh `Enter private viewing`
gesture. A new stream/publication resets that gesture. Loss of discretion or any
other activation gate synchronously replaces the surface and destroys the
protected player.

`Exit now` is persistent while viewing. It unmounts media before showing a
stigma-free settle surface. Support-resource and return-to-Rail affordances are
required host actions rather than decorative text.

The restrained near-black, warm-neutral, and single muted-consent-accent visual
system follows the mandatory frontend guidance. Desktop and constrained mobile
browser renders were inspected; mobile browser coverage validates responsive
layout only and does not change the manifest's prohibition on the native mobile
surface.

## Verification

Passing focused checks on 2026-07-22:

- Aphrodite channel contract/activation: 10 tests;
- complete Phase-A invariant and consolidation suite: 28 tests, including one
  independently named test for every real-channel wall clause;
- kernel ring, first-party-live, and discretion suites: 27 tests;
- affected V10 web component, canonical player, settings, and production
  directory suites: 19 tests;
- BFF exact-subject age assertion and adult opt-in routes: 10 tests;
- Aphrodite Auth assertion/SQL-reader suites: 4 tests;
- canonical age-verification assertion suite: 2 tests;
- desktop and mobile Chromium protected-flow plus production-directory checks:
  4/4, including axe analysis, no pre-gesture media, immediate discretion
  collapse, actionable aftercare, and HG-6 non-exposure;
- strict TypeScript checks for the channel, Phase-A registry, and V10 web;
- targeted ESLint and Prettier checks; and
- filtered offline frozen-lockfile installation.

The Auth test run emits existing missing-source-map warnings for generated
`libs/shared/database/src/*.js.map` files; all selected tests pass. A Next
production build was not run because the 15 GiB host falls under the
repository's explicit small-host prohibition for that broad gate. Targeted
TypeScript, Vitest, and two-browser Playwright coverage exercise the affected
surface instead.