AGENTS.md still claimed "exactly one media session and one matching client are active at a time", which is the invariant this work replaces. It is the normative product-boundary document, so leaving it stale misdirects every future reader. Record what actually holds: one media generation, shared by up to max_viewers authenticated control-v2 clients with no per-viewer capture, encoder, publisher, or actuator; single-client exclusivity retained for control v1 and grouped v3; at most one slot-0 input holder, fully neutralized before a successor is granted; and the authenticated-media and subscription-capability contract, including where the authorization revision comes from.
- commit
- dfe7df56bd3dfba29aeb00d9aab38eae4620bae6
- parent
- b2e61ed63c2f58e5dd0cd541f95c443c8d46dc9a
- author
- Dami <dami.etoile@gmail.com>
| M | AGENTS.md | 25 | +++++++++++++++++++------ |
@@ -16,7 +16,14 @@ Sigil host.
1616 identity, configuration, or Linux input-injection assets.1717 - Iroh owns native connectivity, endpoint identity, encryption, direct-path1818 discovery, and relay fallback.19-- Exactly one media session and one matching client are active at a time.19+- Exactly one media generation is active at a time. Native MoQ control v220+ shares that single generation with up to `max_viewers` authenticated clients21+ (default 3, hard ceiling 8); control v1 and grouped v3 stay single-client22+ exclusive and reject a second client. No capture, encoder, publisher, or23+ actuator scales with viewer count.24+- At most one viewer holds slot-0 input focus. Every other viewer is a25+ spectator, and a former holder is fully neutralized before a successor is26+ granted.2027 - Controller is the primary interaction model. Keyboard and relative mouse are2128 secondary inputs.2229 @@ -58,12 +65,18 @@ Sigil host.
5865 Linux binary was explicitly built with that feature and its runtime5966 GStreamer elements are available. The opt-in backend currently requires CBR;6067 CQP remains on the external compatibility backend.61-- The preferred media path authenticates and claims the single client over62- `sigil/control/1`, then admits that exact peer to a session-scoped upstream63- `iroh-moq` broadcast and static H.264 track. One configured GOP maps to one68+- The preferred media path authenticates each viewer over `sigil/control/2`,69+ then admits that exact peer to one host-owned upstream `iroh-moq` broadcast70+ and static H.264 track shared by every viewer. One configured GOP maps to one6471 bounded native MoQ group; a newer independently decodable group cancels its65- predecessor and provides the latest-frame barrier. The custom media v3, v2,66- and v1 protocols remain explicit compatibility fallbacks.72+ predecessor and provides the latest-frame barrier. `sigil/control/1` and the73+ custom media v3, v2, and v1 protocols remain explicit single-client74+ compatibility fallbacks.75+- Media objects on the shared generation are Ed25519-authenticated against a76+ host-signed generation certificate, and each viewer's MoQ attachment carries77+ an endpoint-bound, expiring subscription capability. The host advertises the78+ authorization revision it minted that capability against in the same accepted79+ control-v2 hello, so a client never has to assume an enrollment revision.6780 - Portal crosses Rust-to-webview video and audio through bounded binary Tauri6881 channels. It reports transport, frontend, decoder, presentation, and audio6982 queue/drop timing separately.