08 · Single-hop and multi-hop authenticated media

Starting state

Sealed admitted active edges and authorized source descriptors; local audio may be active or interrupted on a relay.

Ordered events

1. Source → Relay

   Send hop-authenticated envelope containing protected RTP

2. Relay → Relay

   Validate active role, hop MAC/replay, source SRTP/replay/age

3. Relay → Receiver

   Queue unchanged source ciphertext with new hop header/MAC

4. Relay → Relay

   Try bounded local playback enqueue independently

5. Receiver → Receiver

   Decode due frames, mix sources and render

Fields and messages

Version/hops/age/tag/hop sequence, RTP sequence/timestamp/SSRC and SRTP tag.

Authorization and invariants

Standby/draining cannot consume source replay; failed source authentication cannot forward; valid forwarding does not wait for decode/render.

Timers

Media age below 180 ms; per-link egress TTL 40 ms; ingress 12 packets, per-link egress credits 32; round-robin worker budgets.

Resource lifetime

Ciphertext shared immutably; each outgoing authorization has generation and revocation; source replay outlives route changes.

What the rider sees

Speaking/activity and aggregate media metrics update; no packet content reaches JS.

Failure branches

A slow/broken branch drops/expires its own work; repeated packets are rejected; inactive local playback does not stop forwarding.

Resulting state

Fresh source ciphertext is independently forwarded to eligible branches and optionally queued for local playback.

Evidence boundary

Twelve-source release loopback benchmark, isolation/outbox/authentication tests and simultaneous-tone audio tests.