fix(gateway): enforce audited production traversal

2026-07-30 04:48:02 +07:00
parent d3852d15f3
commit 70667d5aee
17 changed files with 1368 additions and 317 deletions
@@ -8,8 +8,12 @@ The native Apollo backend SHALL derive ANNOUNCE resolution, frame rate, supporte
 - **THEN** the encrypted ANNOUNCE carries those settings and the source-backed HEVC and bitrate attributes

 ### Requirement: Provider policy cannot downgrade
-The gateway MUST reject an invalid, unsupported, audio-disabled, AV1, or capability-mismatched Apollo policy before provider readiness because the current native path cannot truthfully honor those combinations.
+The gateway MUST use the generated Protocol intersection to select only a registered profile compatible with the immutable policy. It MUST reject invalid, unsupported, no-overlap, downgrade, audio-disabled, AV1, or provider/source-mismatched Apollo policy before `/applist`, `/launch`, or provider readiness because the current native path cannot truthfully honor those combinations.

 #### Scenario: Unsupported policy fails closed
- **WHEN** authenticated provider work selects audio disabled, AV1, or a codec outside the negotiated client-decode profile
- **THEN** setup fails before readiness without falling back to H.264, stereo, or another local default
+- **WHEN** authenticated provider work selects audio disabled, AV1, a codec outside the registered peer intersection, or a resolution, frame rate, bitrate, audio, or codec combination outside source-backed Apollo support
+- **THEN** setup fails before application discovery or launch without falling back to H.264, stereo, a cap, or another local default
+
+#### Scenario: Independent peers negotiate one registered profile
+- **WHEN** a production gateway and independent client advertise overlapping registered H.264 or HEVC profiles
+- **THEN** admission selects the first policy-compatible common profile using shared Protocol behavior
@@ -13,3 +13,10 @@ The established authenticated path SHALL expose observed bytes, packets, drops,
 #### Scenario: Telemetry snapshot is published
 - **WHEN** the gateway emits a heartbeat after forwarding traffic
 - **THEN** it carries the bounded process-level observations and no high-cardinality or secret-bearing value
+
+### Requirement: Production delays have disjoint sample semantics
+Queue delay SHALL measure provider-queue residence, processing delay SHALL measure provider recovery plus framing and QUIC handoff work excluding queue and pacing, and pacing delay SHALL measure scheduler waiting only. The gateway SHALL advance processing samples once per complete provider media unit even when it emits multiple Verse frames.
+
+#### Scenario: Known production waits
+- **WHEN** one provider media unit has controlled enqueue, processing, and pacing intervals and fragments across multiple frames
+- **THEN** each cumulative total reports only its intended interval and exactly one processing sample is retained through authenticated Server persistence
@@ -1,18 +1,18 @@
 ## MODIFIED Requirements

 ### Requirement: Fixed media processing qualification
-The qualification harness SHALL drive the source-shaped provider fixture through Apollo recovery/FEC, bounded production queues, the production fair pacer, Verse framing/QUIC, and an independent client for 1080p60 H.264 at 20 Mbps, 1440p120 HEVC at 50 Mbps, and 4K60 HEVC at 80 Mbps. After a recorded warm-up, the frozen candidate SHALL run each profile for ten wall-clock minutes, preserve encoded payload bytes, retain every monotonic processing sample plus bounded CPU, memory, goroutine, and allocation observations, and report count, min, median, p90, p95, p99, max, mean, standard deviation, timing overhead, and observed bitrate. Any payload mutation or p95 above 5 ms SHALL fail.
+The qualification harness SHALL drive pinned-mTLS Apollo management, encrypted RTSP, ENet, and provider UDP through native source validation, `readUDPMedia`, recovery/FEC, bounded production queues, the production fair pacer, Verse framing/QUIC, and a public or independent client decoder for 1080p60 H.264 at 20 Mbps, 1440p120 HEVC at 50 Mbps, and 4K60 HEVC at 80 Mbps. After a recorded warm-up, the frozen candidate SHALL run each profile for ten wall-clock minutes, preserve encoded payload bytes, retain every monotonic processing sample plus bounded CPU, memory, goroutine, allocation, and provider-queue observations, and report count, min, median, p90, p95, p99, max, mean, standard deviation, timing overhead, and observed bitrate. Processing begins at complete provider-unit receipt and ends at QUIC handoff, excluding client transit. Any bypass, payload mutation, wall-duration violation, bitrate outside both lower and upper bounds, or p95 above 5 ms SHALL fail.

 #### Scenario: Healthy fixed profile
 - **WHEN** a frozen candidate runs one fixed profile for the normative duration
 - **THEN** the harness emits compressed raw path and resource samples plus a summary tied to the exact command, topology, source commit, immutable Protocol version, environment, and payload hash

 #### Scenario: Processing gate failure
- **WHEN** any production path stage is bypassed, payload integrity fails, or measured p95 exceeds 5 ms
+- **WHEN** any production path stage lacks a per-traversal observation, payload integrity fails, duration or bitrate bounds fail, or measured p95 exceeds 5 ms
 - **THEN** the qualification command exits unsuccessfully without recording a passing candidate

 ### Requirement: Bounded impairment qualification
-The harness SHALL run exactly the baseline, latency, jitter, loss, reorder, and constrained Section 7.2 profiles once against traffic traversing the production gateway path. Baseline SHALL cover all three media profiles and the other profiles SHALL cover 1080p60. Each artifact SHALL retain raw impairment observations and record tool version, exact command/configuration, environment, candidate commit, immutable Protocol version, direction, queue discipline, topology, fixed seed, and observed RTT, jitter, loss, reorder, throughput, drops, and capacity-step statistics.
+The harness SHALL run exactly the baseline, latency, jitter, loss, reorder, and constrained Section 7.2 profiles once by applying impairment at the source-shaped provider UDP boundary while traffic traverses the production gateway path. Baseline SHALL cover all three media profiles and the other profiles SHALL cover 1080p60. Each artifact SHALL retain raw impairment and queue observations and record tool version, exact command/configuration, environment, candidate commit, immutable Protocol version, direction, queue discipline, topology, fixed seed, and observed RTT, jitter, loss, reorder, throughput, drops, and capacity-step statistics.

 #### Scenario: Complete six-profile run
 - **WHEN** the frozen candidate runs impairment qualification
@@ -1,11 +1,11 @@
 ## ADDED Requirements

 ### Requirement: Provider terminal events end forwarding
-Encrypted provider termination and unexpected provider disconnect SHALL stop media forwarding, close the Verse tunnel within a bounded interval, release the session reservation, and report the appropriate durable provider/session state.
+Encrypted provider termination and unexpected provider disconnect SHALL quiesce provider ingestion and queued/new media forwarding before the existing reliable typed terminal event is delivered, close the Verse tunnel within a bounded interval, release the session reservation, and report the appropriate durable provider/session state. A fixed drain delay MUST NOT stand in for reliable control delivery.

 #### Scenario: Host termination closes the tunnel
 - **WHEN** the native provider emits an authenticated termination event
- **THEN** no later provider media is delivered and the client tunnel, reservation, and durable lifecycle transition complete
+- **THEN** queued and newly injected media cannot cross the Verse transport after observation, and the client tunnel, reservation, and durable lifecycle transition complete

 #### Scenario: Unexpected provider disconnect is reconnectable
 - **WHEN** required provider transport disconnects without acknowledged termination