### `wai.age.assurance`: content ratings carried through derivations, admission by an age threshold without identity, and the minors' profile

- **The extension** ([age-assurance](extensions/age-assurance.md)) registers the record
  `wai.age.assurance` and three JSON records signed as synthesis' are: a rating claim
  (`wai-rating`), an age policy (`wai-age-policy`) and an admission receipt
  (`wai-age-admissions`).
- **Rating claims.** A claim rates an object, a track from a group on, a span of a track or a
  room under one to eight schemes, each named by its vocabulary URI, with the value it gives and
  the minimum age that value means; several national schemes sit side by side and WAI adds none.
  An object's age is the greatest age of the claims that cover it, so a claim only raises, and a
  span rated after its first group went out holds from that group whenever the claim arrives
  (§3.5): a relay serves none of the span below its age from then on, live, by FETCH, from the
  cache or from the DVR window. A derived object's claim names its inputs' claims by link hash,
  and a derivation that names no claim for a rated input, or drops or lowers a scheme an input
  is rated under, is refused `rating_dropped` (§3.4), as synthesis §3.4 carries an origin class.
  A room's tracks are rated by its room keys and each track by its owner, and a claim another key
  signs is refused `rating_not_authorised`.
- **Admission by threshold.** A room's age policy, signed by its authority, names Privacy Pass
  issuers (RFC 9576, RFC 9577, RFC 9578) with one key per threshold, from 1 to 21, so a token of
  the publicly verifiable type 0x0002 says "at or over *T*" and nothing else. A relay checks a
  token in six steps (§5.2): it reads, its challenge is one the relay sent the session, its key
  is the named issuer's, its RSASSA-PSS verifies, its nonce was not redeemed, and its key's
  threshold is at least the track's age; it learns the issuer and the threshold alone. A grant
  states the threshold its authority admitted the principal under in the attribute `age`
  (live-rooms §4.4).
- **No return path.** On a one-way bearer a rating is a sink-evaluated predicate: the device's age
  state is the greatest threshold of a credential it holds under an anchor provisioned on it,
  each credential a token issued for the issuer's device challenge, and a player presents an
  object only at or above its age, evaluates again as claims arrive, and sends nothing (§6).
- **Evidence without identity.** An admission receipt, signed by a room key, counts admissions
  per window, issuer and threshold; a cell under 50 is suppressed, as live-metering's QoE cell is
  under delivery-telemetry §8 (its paragraph 8.4); and a member beyond its table, at its top or in a cell, is
  refused `receipt_identifies`, whatever it holds. Given the admissions, a verifier recomputes the
  cells. Where a regime asks the operator for a lawful basis, the operator states it in a
  `lawful-basis` declaration (jwp-receipts §2.4.6) about the receipt.
- **The minors' profile.** A room in which a grant that may publish and carries `minor` = `true`
  takes effect must meet the profile, named from bitmaps it already has: recording `mode` 0, no
  role with the record or the seek power, no role that publishes nothing permitting `chat` or
  `reaction`, and no grant that publishes nothing permitting them either; otherwise
  `minor_profile_unmet`. WAI defines no gift; a clip needs a recording or a DVR window, and the
  room has neither.
- **live-recording** §4.4 step 5 refuses a package of a room whose recording policy has `mode` 0
  (`recording_not_permitted`, capture-binding's code), takes or no takes; its corpus gains
  `room_never_recorded`, and `live_record_verify.py` the check.
- **The relay** (`joule-moq-relay`) keeps no DVR window of a room once a session proves a minor's
  publishing grant of it: what it held is deleted, nothing more is written, and the room is
  remembered across a restart, as a room whose objects are sealed is; `joule-moq`'s grant head
  reads the `minor` attribute.
- **Conformance.** `wai-rs` gains the `age_assurance` module (feature `age_assurance`), reusing the
  ad-presentation module's RSASSA-PSS and token reader; `live-conformance/age/` is written by
  `wai_age_assurance_vectors` from fixed seeds, its issuer keys the published test keys of RFC
  9578 Appendix A.2, RFC 9500 §2.1 and RFC 7517 Appendix A.2, with RFC 9578's first token vector;
  and `live-conformance/age_assurance_verify.py`, written from the text, is its second
  implementation.

