docs(openspec): archive gateway audit remediation

openspec/specs/apollo-stream-policy/spec.md

@@ -0,0 +1,23 @@
+# apollo-stream-policy Specification
+
+## Purpose
+TBD - created by archiving change phase3c-gateway-audit-remediation. Update Purpose after archive.
+## Requirements
+### Requirement: Apollo launch consumes the effective policy
+The native Apollo backend SHALL derive ANNOUNCE resolution, frame rate, supported codec, selected bitrate, and audio profile from authenticated `ProviderSessionWork`, and MUST NOT substitute local defaults.
+
+#### Scenario: Supported HEVC policy reaches Apollo
+- **WHEN** provider work selects HEVC at 2560×1440, 120 FPS, 40000 Kbps, with audio enabled
+- **THEN** the encrypted ANNOUNCE carries those settings and the source-backed HEVC and bitrate attributes
+
+### Requirement: Provider policy cannot downgrade
+The gateway MUST use the generated Protocol intersection to select only a registered profile compatible with the immutable policy. It MUST reject invalid, unsupported, no-overlap, downgrade, audio-disabled, AV1, or provider/source-mismatched Apollo policy before `/applist`, `/launch`, or provider readiness because the current native path cannot truthfully honor those combinations.
+
+#### Scenario: Unsupported policy fails closed
+- **WHEN** authenticated provider work selects audio disabled, AV1, a codec outside the registered peer intersection, or a resolution, frame rate, bitrate, audio, or codec combination outside source-backed Apollo support
+- **THEN** setup fails before application discovery or launch without falling back to H.264, stereo, a cap, or another local default
+
+#### Scenario: Independent peers negotiate one registered profile
+- **WHEN** a production gateway and independent client advertise overlapping registered H.264 or HEVC profiles
+- **THEN** admission selects the first policy-compatible common profile using shared Protocol behavior
+