LISTENER-QA-01 — Staging acceptance, load soak and release rollback

[nicoechaniz]

Objective

Accept the current Harmonic Beacon Listener for public launch while keeping it isolated from events, Proyección del Mito and live.harmonicbeacon.com.

Current accepted baseline — 2026-08-15

• Exact public Listener 5d1073f598272d81a14a64d55a4220c2c13e9a74; previous application rollback acc90ba35fea52f63ef18337e3a555ef637c552f; pinned no-port withdrawal operator 0a475717d45d32cec38afdb8fc35fb772a994017 survives app rollback.
• Exact membership authority 4e5b208e902969285c8f68067f7fd13b7e2eb68d, healthy with restart=0.
• Three-hour weekly Free quota with server time, no rollover, union consumption and two-device cap.
• Google login/logout/re-login and real-browser email magic link; ES/EN intro, direct Beacon, intro→Beacon, Stop and accepted iPhone playback.
• PayPal Sandbox and Mercado Pago TEST browser lifecycle acceptance.
• Canonical Founder status/cancel/reactivate/terminal Free fallback.
• Health/readiness, private metrics/alerts, kill switch, backup/restore and same-DB roll-forward recovery.
• Public no-login withdrawal/service-cancellation routes, immediate opaque receipts, root-only operator and 20h/24h alerts.
• Hermetic fonts and bounded silence watchdog/same-lease recovery.
• Abandoned PayPal Live approval safely retired after provider 404 with no charge, subscription, Founder state or blocking binding.
• Public sales, both public Live checkout flags and private Live workbench are OFF.
• Prometheus/Alertmanager have no active alerts; host memory and root disk are below thresholds.

Release gates

• P1 Listener — Audio becomes silent while analysis frames continue #304 physical 60-minute audible playback/watchdog soak, including Stop→re-entry.
• LISTENER-BILLING — Self-service membership status, cancellation and reversal #317 final physical mobile/account-menu billing acceptance.
• LISTENER-COMMERCIAL — Public offer, billing terms and launch copy #318 final human ES/EN copy/legal/provider-descriptor/invoicing/refund review.
• LISTENER-BUILD — Make production font builds hermetic #327/fix(build): self-host application fonts #329 hermetic font build with Google Fonts blocked.
• LISTENER-SEC — Rotate exposed Google OAuth client secret #328 replacement Google OAuth client deployed and old client revoked.
• LISTENER-ID-02 — Passwordless email magic-link fallback #217 fresh email delivery → one-use callback → isolated email-only Free session → logout.
• Automated exact-runtime Chromium and Firefox smoke at desktop and 390×844 ES/EN, with no console/page errors.
• Physical Android Chrome and iPhone Safari smoke on the exact release candidate, including output-route behavior where applicable.
• First external media-plane smoke: 10 clients / 60 seconds from daimonmatrix, 348/348 requests successful, zero misses/restarts/OOM/alerts and clean five-minute baseline/recovery.
• External capacity progression may claim only levels actually measured; the 3k/4k/5k artifacts are zero-request plans, not capacity evidence.
• LISTENER-LIVE — Install and validate productive provider lanes #335 productive credentials root-only, read-only preflights green and stale PayPal intent repaired; public sales OFF.
• One separately and explicitly approved supervised Live lifecycle per provider.
• Aggregate PR draft: build isolated Founding Listener candidate #203 green and mergeable at integration head e337f93101be941bf7b3d1b3138c1a6b20ccb915.
• Exact-provenance release candidate 5d1073f598272d81a14a64d55a4220c2c13e9a74 deployed only to Listener with health/readiness/HTTPS and rollback evidence.
• Re-run proportional release gates if any code changes after human acceptance.
• Explicit approval for early-birds → main and public checkout.

Guardrails

• No load, deploy or restart of event app, LiveKit, playlist, tapestry or event audio.
• No real payment without explicit approval.
• No old daily-window/welcome or experimental compatibility criteria are release authority.
• Optional visualization laboratory ideas do not block launch unless they cause an audio/accessibility regression.

[nicoechaniz]

Release convergence depends on #194, #195, #196, #197, #198, #199 and #200 plus the external DNS/TLS, OAuth, Telegram and explicit Nico audio approvals. Staging can proceed with synthetic identities and entitlements before real credentials exist.

[nicoechaniz]

Fast Forward checkpoint on shared early-birds: isolated synthetic preview scaffold integrated at 2158b3c and hardened at d9f2bd8. It has a separate PostgreSQL/project/volume, bounded existing stream origin, no event services, synthetic env guard, migration rehearsal, health smoke, stop and origin rollback. Three contract tests, resolved Compose validation and an independent stream image build pass. Remaining before closure: Listener overlay after EB-03/05, DNS/TLS propagation, approved audio artifact and decoded canary, OAuth/sandbox membership integration, physical-device listening and external load/soak. No production deploy or real data/payment occurred.

[nicoechaniz]

Staging checkpoint (2026-08-06): https://earlybirds-staging.harmonicbeacon.com and https://stream.harmonicbeacon.com are live with valid TLS. Listener app 3ec91cf is deployed; ops/runtime fixes through 13f899b are deployed. DB-backed team entry and canonical Free invitation E2E pass. Nginx blocks internal/event/ops surfaces, authority is private-only, all runtime health checks pass, and live.harmonicbeacon.com stayed HTTP 200 throughout deploy and rollback rehearsal.

Rollback evidence: Listener/origin stopped, staging health became 502 as expected, preview PostgreSQL remained healthy, production remained 200; restart restored full smoke and staging 200. Observability scrapes are all up and the canary reports 1.

Remaining before closure: human Free acceptance; Google/Apple credentials/callbacks; Telegram bot/chat ID and delivery test; explicit audio-format approval, real derivative, browser/physical listening and decoded canary; external distributed load/soak; clean final convergence with current main. PayPal/MercadoPago are still fail-closed and no real checkout/data was used.

[nicoechaniz]

Additional Free acceptance evidence at webapp a1e24de (2026-08-06): the dedicated EarlyBird responsive/browser boundary passed 8/8 against a migrated disposable PostgreSQL fixture at 1440, 1024, 390 and 320 px. ES→EN copy and document language changed correctly, the staging entry form stayed in bounds with no horizontal overflow, the private Listener rendered at every width, and instrumentation observed zero camera/microphone requests. Full pre-commit Vitest remained 985 passed / 19 expected DB skips; PR CI is green. Physical Safari/Android, real OAuth, approved audio and human Free invitation acceptance remain separate rows, not implied by this emulation.

[nicoechaniz]

Staging acceptance checkpoint (2026-08-06)

Deployed revisions:

• Listener: 2ee36adf36f0364862b62b0bb0c5df5d49086cc0
• Free authority: 83deaaee1ae3c5adce910c80249a0229ab4199e5

Automated gates:

• public Listener health 200 with exact SHA; origin /healthz 200; production health remained 200;
• isolated app/origin/PostgreSQL health smoke passed;
• Free lifecycle + durable reconciliation smoke passed;
• real-browser public landing passed ES/EN and no-overflow at 1440/1024/390/320 (4/4);
• local authenticated responsive suite passed 8/8 across the same viewports;
• PR draft: build isolated Founding Listener candidate #203 and authority PR [review] Playlist bot: fallback keys off participant presence, not live audio #39 are clean with all non-skipped CI green.

Still intentionally pending: Nico/team physical human acceptance; approved audio derivative/listening; external load execution; OAuth credentials; Telegram bot/chat configuration. PayPal/MercadoPago are disabled and app stores are post-MVP.

[nicoechaniz]

Real-browser canonical Free rehearsal (2026-08-06)

A disposable invitation exposed and then verified a staging-only reentry defect: the protected synthetic seam attempted sign-up before sign-in, so a quick second device could hit Better Auth account-create rate limiting. Fixed in 806fe9c by signing existing accounts in first and falling back to one bounded sign-up only for a new identity; regression tests cover both orders.

Exact 806fe9c6e2ae162c46d841e71813be477c4e58a5 is now deployed and healthy. Chromium against public staging passed: canonical invite activation, active FREE membership, immediate same-account reentry, zero camera/mic requests, zero team-secret persistence, zero horizontal overflow, authority revocation/reconciliation, and truthful denial when replaying the revoked invitation. The unused supervised human invitation was not consumed. Full gate: 1001 pass / 19 expected skips; TypeScript/lint/build and production health are green.

[nicoechaniz]

Final external-gate matrix for the Free-first staging milestone (2026-08-06)

Everything independently executable is green and deployed. Resume conditions are now exact:

1. Human Free acceptance: Nico/team consumes the preserved supervised invitation on physical Chromium/Firefox/Android/iOS and records the rows in docs/operations/EARLY_BIRDS_FREE_ACCEPTANCE.md.
2. Audio approval: Nico approves a concrete derivative/stream format before any real Beacon artifact is generated or published. Current staging remains a non-audio synthetic fixture.
3. OAuth: provide/register Google and Apple client material for the documented exact callbacks; code and disabled UI are ready.
4. Telegram: provide root-only bot token and chat ID, then start Alertmanager and execute warning/critical/recovery delivery.
5. Capacity execution: after approved audio/signing, run the already-proven 10-client external step and only then advance by monitored go/no-go; the deterministic 3,000-client four-shard plan is prepared but has sent zero traffic.
6. Paid providers: only after Free human acceptance and a separate explicit approval, resume LISTENER-PAY-01 — PayPal sandbox Founding Listener lifecycle #199/LISTENER-PAY-02 — MercadoPago and BCRA Founding Listener price lock #200; both remain fail-closed.

Current evidence: deployed Listener 806fe9c6…; branch/docs c7c1f6d; authority 83deaaee…; PR #203 and authority PR #39 clean with CI green; staging/origin/production health 200. No code overlap from Annie/Mariano was found in the final coordination check.

[nicoechaniz]

Human Free playback finding (2026-08-06): identity, canonical membership, lease, heartbeat and same-origin manifest all returned 200 in the real authenticated browser, but playback correctly failed because staging still served the intentionally non-decodable 3/5-byte synthetic protocol fixture. This is not an auth/lease regression; it is the remaining audio approval gate and proves why the decoded-audio canary is required in addition to HTTP HLS health. Private drop-ins are also truthfully unavailable because no approved derivative has been published.

The selected long Beacon source already exists on the data volume at 48 kHz stereo Float32, duration 6844.426438 s, 2,628,259,840 bytes. A read-only inventory was written root-only with SHA-256 479b4132fc44766e3e1316fad21681685d4a7cb3d1f81a365ddb72f95e4e6d89. Encoding/publishing remains paused under the audio guardrail pending Nico’s explicit approval of the proposed AAC-LC 320 kbps, 48 kHz stereo staging derivative. No event audio path was touched.