2.4 KiB
ADDED Requirements
Requirement: Authenticated bounded gateway transport
The gateway SHALL require TLS 1.3 client authentication and a valid versioned grant hello before allocating provider state. Reliable lifecycle/control/critical-input messages SHALL use streams; encoded media/audio and approved sequenced input SHALL use bounded DATAGRAMs.
Scenario: Grant replay or wrong audience
- WHEN a client presents a consumed, expired, revoked, or audience-mismatched grant
- THEN the gateway rejects before provider allocation and emits no provider route or credential to the client.
Requirement: No-transcode encoded relay
The gateway SHALL relay provider encoded payload bytes through a codec-neutral Verse envelope without decode, encode, transcode, render, or codec conversion.
Scenario: Payload relay
- WHEN the fake Apollo provider emits an encoded video or audio payload
- THEN the corresponding Verse payload is byte-identical except for the approved transport framing and the gateway records no decoder/encoder operation.
Requirement: Provider identity and protection
The Apollo profile SHALL reject changed, malformed, expired, or not-yet-valid pinned identity and SHALL never silently retry with weaker protection.
Scenario: Identity change
- WHEN the provider identity differs from the enrolled fingerprint or unique ID
- THEN launch fails closed and the session remains unavailable for new media.
Requirement: Bounded lifecycle and input safety
Authority loss, tunnel close, drain, provider disconnect, and explicit termination SHALL be distinct states; every pressed key/button/controller SHALL be released before session cleanup.
Scenario: Authority expiry during input
- WHEN authority expires while input is pressed
- THEN new input is rejected, release-all is sent to the provider, queues stop, and cleanup is reported as pending until termination is acknowledged.
Requirement: Deterministic fake-provider qualification
The complete management, launch/readiness, channel, feedback/input, termination, and cleanup sequence SHALL pass against a bounded fake provider plus malformed and timeout fixtures.
Scenario: Fake provider timeout
- WHEN readiness or termination times out
- THEN the adapter returns a bounded stable error and marks cleanup pending without spawning unbounded retries or goroutines.