Feature request: Support Apple's new official HomeKit Secure Video open-source spec

[ovcrash]

Feature request: Support Apple's new official HomeKit Secure Video open-source spec (WebRTC + HEVC + CMAF)

Context

On June 3, 2026, Apple published the HomeKit Secure Video Open Source
Compatibility Guide (Developer Preview), an official specification that
opens HKSV to open-source camera implementations:

https://developer.apple.com/download/files/HomeKit-Secure-Video-Open-Source-Compatibility-Guide.pdf

It complements HAP spec R17+ and defines new HAP services and
characteristics for IP camera accessories. The headline features:

• WebRTC streaming (camera-webrtc-stream-management, UUID 8033):
  SDP offer/answer + ICE candidates exchanged over HAP characteristics,
  optional SFrame end-to-end encryption. Replaces the legacy SRTP/RTP
  flow for live view (a full call sequence diagram is in chapter 5).
• HEVC is mandatory, alongside H.264 (Video Codec enum: 1 = H.264,
  2 = H.265). Opus is the only audio codec.
• Multi-tier streaming: at least 3 simultaneous encodings per sensor
  (e.g. 4K/2K High, 1080p Medium, 360p Low), advertised via
  supported-video-stream-tiers TLV8s with target bitrates per tier.
• Native HKSV recording via CMAF Ingest: fMP4 publishing to a
  camera-recording-publishing-point URL, with client certificate
  provisioning (CSR flow) and key management services.
• Minimum 5 concurrent RTP sessions and 6 concurrent WebRTC sessions.

Why go2rtc is a great fit

go2rtc already has almost all the building blocks:

• a working HomeKit accessory server (pairing, mDNS, HAP transport)
• a mature WebRTC engine (SDP/ICE negotiation)
• HEVC and Opus support in the streaming pipeline

The main new pieces would be the HAP-side glue (new TLV8
characteristics, the WebRTC solicit-offer/provide-answer flow over HAP)
and, for HKSV recording, the CMAF ingest client (fMP4 upload + client
cert provisioning).

What this would enable

• Near-instant stream startup in the Apple Home app (WebRTC instead of
  the legacy SRTP negotiation)
• No more forced H.264/Opus transcoding for H.265 cameras
  (#video=h264 workarounds would no longer be needed)
• HomeKit Secure Video recording for any camera exposed through
  go2rtc — without Scrypted or reverse-engineered HKSV

This would also directly benefit Frigate users, since Frigate bundles
go2rtc and already documents the go2rtc → HomeKit path.

Notes / caveats

• The spec is a Developer Preview: the Camera Capabilities and
  Motion Zones version strings are 17.99 and explicitly "may be
  updated prior to release", so an experimental flag might make sense.
• Supported RTP Configuration must be AES_CM_128_HMAC_SHA1_80.
• Opus capture sample rate: 16 kHz mandatory, 24 kHz recommended
  (transmission always reported as 48 kHz).