### Live ingest and egress: WHIP and WHEP onto a room's tracks, E-RTMP v2 and SRT mapped

- **The extension** ([live-ingest](extensions/live-ingest.md)) binds the contribution and
  playback protocols of standard encoders and players to the tracks of a room. No record
  and no capability of its own; no new transport and no new token format.
- **Admission (§3).** A WHIP or WHEP bearer token is a room grant, `WRG1` in base64url. A
  gateway checks it against the room's descriptor as live-rooms §4.3 does, then its window,
  the room's revocations, its origins and its single-use nonce, and answers `401` with
  RFC 6750's challenge; a good grant without the power a request needs (publish for each
  media kind of a WHIP offer, subscribe up to the layer for WHEP) is `403`
  `insufficient_scope`. Every request with a grant carries a proof of possession of its key
  (live-rooms §10.5.3): `WAI-Room-Proof` over a single-use `WAI-Room-Challenge`, refused with
  live-rooms' `pop_*` reasons.
- **Tracks and objects (§4, §5).** A WHIP session publishes a layer-0 media track per kind,
  each with its receipts track, and the owner's catalog with a receipts track of its own.
  Each frame is one object, one `WAI1` envelope in its capability's framing: an H.264 access
  unit in Annex B, a VP8 or VP9 frame in one-frame IVF, an AV1 temporal unit in SPEC §5's
  framing, one Opus packet. The objects of a live track, from a group's first, are one
  stream of the codec. Video groups begin at keyframes; audio groups are fixed windows on
  the room clock. A track's first group ID is its first frame's room-clock time, so a
  publisher that reconnects continues above the IDs it used.
- **Time (§6, §7).** The manifest's new `live` member carries the frame's room-clock time,
  its RTP time and, on a group's first object, the grant reference of live-rooms §4.5. RTP
  time maps to the room clock from the track's first frame, re-anchored past `max_skew_ms`,
  so every frame's time lies within that bound of its arrival at the gateway.
- **Receipts (§8).** The gateway signs each group's receipts as the first hop, after the
  group's last object, chained per track on an alias derived per session. They state what
  the gateway received, not what the publisher signed.
- **WHEP (§9).** An egress session reads the owner's catalog once its receipt verifies,
  joins each track at its latest group, and verifies every object (its receipt's group and
  Object ID, the signature under a trusted first hop, the chain, the inclusion proof, the
  envelope) before the frame reaches the player; what fails is dropped and counted. A WHEP
  player sees no receipt; a WAI-aware player subscribes over MoQ and verifies itself.
- **Mapped, not yet implemented (§12, §13).** E-RTMP v2 multitrack: `capsEx`, the stream
  name as the token, tracks by the grant's profile layers, FourCCs to capabilities, the
  reconnect request. SRT 1.5.7: a one-time session ID from an HTTP exchange in the stream
  ID's `s` key, rejection codes from the HTTP statuses, MPEG-TS stream types to
  capabilities, latency.
- **How an ingest relates to a take (§15)** and **to metering (§16)**: an ingest is the live
  tier, never a `single-take`; a device that speaks capture binding still commits its take
  beside its WHIP session. Each gateway session ends with a signed record in the shape of
  live metering's per-hop record.
- **Reference.** `joule-moq-ingest` in `joule-code/joule-code-rs/crates/`, on `str0m`
  (sans-IO WebRTC, its pure-Rust crypto backend). Its reading of rooms and grants is held to
  `live-conformance/rooms/`.

