draft: build isolated Founding Listener candidate

[nicoechaniz]

Status

Integration PR for milestone EarlyBirds. Draft: do not merge to main or deploy into the event stack. The isolated acceptance candidate runs at https://listen.harmonicbeacon.com/ with origin https://stream.harmonicbeacon.com/. live.harmonicbeacon.com, event audio and Proyección del Mito remain unchanged.

Exact candidate

• Deployed Listener application: ae1d0baa4527a74c2908f84692e677f5b96f615a.
• Operational smoke head: 8444ed7d06b2764c519f65ce4d32932346a94fdd.
• Current integration/documentation head: d3a667c862df77d06d3a63e72331cb48102b1989.
• Listener schema: 20260808160000_listener_weekly_quota.
• Policy marker: personal-7-day-v1.
• FFA: OFF.
• Recovery: stop/kill-switch and roll forward. Pre-weekly experimental images are unsupported.

Health must attest the deployed application SHA, not a later docs-only head.

Current product

• Registered Free accounts receive three hours per exact seven-day cycle.
• The cycle starts at the first real authorized playback; page load and idle preparation do not start it.
• Base time does not roll over. Daily schedules, timezone/DST selection and the separate 30-minute welcome grant are retired.
• Intro and Beacon both consume quota. Two devices consume their listening union once; a third displaces the oldest.
• Stop, disconnect, stale heartbeats, lease expiry and exhaustion are bounded and server-authoritative.
• Active canonical membership and FFA are unlimited and non-metered.
• Future collaboration credits use server-only, idempotent, auditable grants with optional expiry and no PII. No quest engine is included.
• Google OAuth remains enabled. Apple stays hidden pending Developer Program credentials. Magic link stays hidden pending SairaAsua/proyecciones-mito#44.
• Renewal is presented as days and hours (7d, then 6d 23h) rather than a large raw hour count.
• New Listener sessions start at the explicitly approved 70% media-element volume.
• Introduction playback is one pre-play checkbox; its language menu is dark, readable and keyboard-focused. Setup disappears while playback is active.
• Intro choice, volume and transport now share one coherent panel. Pause is the large left action during an intro; Stop is the small right action. Weekly balance and renewal sit quietly at the bottom with a membership contact action.
• Prepared-source revalidation no longer creates a silent first-click claim. Exceptional capacity claims are truthfully labeled before Listen is offered, and Free-account ES/EN range requests remain authorized under concurrent quota heartbeat settlement.

This is an experimental pre-release. We do not retain compatibility with discarded Free-policy variants. Historical migrations remain immutable, but daily/welcome APIs now return 404 and old clients/binaries are not supported.

Safety boundaries

• The only acoustic presentation change is Nico's explicit approval of 70% initial Listener volume. No asset, codec, bitrate, sample rate, channel, fade, buffer or routing parameter changed.
• No event, LiveKit, playlist-bot, tapestry, staff capability, payment or Proyección del Mito surface changed.
• Listener media remains signed and generation/lease bounded.
• Free, FFA and invitations cannot fabricate Founder eligibility, membership or Purchase.
• Paid providers remain disabled; no real charge is authorized.

Verification

• 1,401 tests passed / 28 standard skips at the final code checkpoint.
• TypeScript, ESLint, production build, Prisma validation, frozen-audio, preview, stream-origin and observability gates passed.
• Fresh PostgreSQL 16 applied all 18 migrations; Founder + weekly quota PostgreSQL tests passed 9/9.
• Deployed smoke proved a virgin weekly account, first-play anchor, three-hour allowance, removed legacy APIs, two-device eviction and generation-bound manifests.
• Public health attests exact SHA/schema; app, database and origin are healthy.
• Event container/image/restart count remained unchanged.

Exact evidence and recovery instructions live in docs/operations/FOUNDING_LISTENER_RELEASE_CANDIDATE.md and docs/operations/EARLY_BIRDS_STAGING_PREVIEW.md.

Remaining human acceptance

• Real Google login on the weekly deployment and one valid synthetic invitation flow.
• Visible countdown: play, Stop, restart, exhaustion/reset without reload.
• Physical Chrome, Firefox, Android and the quota-signaling recheck on iPhone.
• One 60-minute physical listen including intro, handoff, background/foreground, network transition and Stop/rejoin.
• Stepwise external load before making any measured capacity claim.
• Magic-link backend delivery, optional Apple credentials and payment sandboxes remain separate blockers/features.

No merge to main, paid activation, real charge, worldwide campaign or event deployment is authorized by this draft.

Tracking: #195–#201, #210–#219 and post-milestone #202.

[nicoechaniz]

Staging deployment checkpoint: exact head 2ee36adf36f0364862b62b0bb0c5df5d49086cc0 is healthy at https://earlybirds-staging.harmonicbeacon.com. Branch CI is green; public browser ES/EN responsive smoke passed 4/4; isolated Free lifecycle against authority 83deaaee1ae3c5adce910c80249a0229ab4199e5 passed end to end. This remains a draft pending human/audio acceptance and is not approved for main or production.

[nicoechaniz]

Documentation-only head e44622d now records the exact deployed Listener 2ee36adf…, authority 83deaaee…, current Free lifecycle/browser evidence and the external zero-request load-plan rehearsal. The deployed application remains intentionally attested at 2ee36adf…; no rebuild is needed for this docs-only commit. Full pre-commit Vitest: 999 pass / 19 expected skips.

[nicoechaniz]

Staging head checkpoint: application 806fe9c6e2ae162c46d841e71813be477c4e58a5 is deployed and healthy; docs-only head is f72c331. Real-browser canonical Free activation, immediate same-account reentry and post-revocation denial all passed. The defect/fix is staging-seam-only and adds no event capability. Full local pre-commit suite is 1001 pass / 19 expected skips; frozen-audio boundary remains unchanged.

[nicoechaniz]

Docs-only head c7c1f6d records the reproducible distributed 3,000-listener plan: four deterministic shards across two external NTP-synchronized generators, identical plan hash, exact 3,000-client coverage and zero network requests. The deployed Listener remains exact application SHA 806fe9c6…; this docs update does not require a staging rebuild.

[nicoechaniz]

Staging ops checkpoint: commit ab0ac13 fixes unprivileged Alertmanager secret access via a networkless initializer/private 0400 runtime volume. Dedicated Telegram FIRING/RESOLVED routing, readiness and Prometheus discovery passed without leaking secrets. Root build-cache pressure was reduced from 83% to 64% using only unused cache older than 24h; the origin artifact bind now lives on /mnt/beacon-data with the old fixture retained for rollback. Origin, Listener, canary, all scrape targets and production health remain green. Full evidence: #195.

[nicoechaniz]

Staging audio acceptance update (2026-08-06)

• Deployed EarlyBirds Listener f90e67b and origin/artifact support through 019934d; production remained untouched and healthy.
• Long Beacon master SHA-256: 479b4132fc44766e3e1316fad21681685d4a7cb3d1f81a365ddb72f95e4e6d89.
• Reviewed derivative: AAC-LC, 48 kHz, stereo, requested 320 kbps target; actual encoded stream ~248.7 kbps, 6844.427 s, SHA-256 9bdee8b30173237ee7d1f29b04840a2704a77ab30011784aec2dcc861c8284a8.
• Artifact beacon-luz-20260624-aac320-v1: 1,141 fMP4 media segments plus init map; every file checksum-verified. Public signed manifest decoded for 12 seconds with ffmpeg.
• New Amara source SHA-256 d97266b5d06197386477fba8510704586c96a4109a60ac4313c1338643784360. Measured -12.7 LUFS; Beacon measured -35.6 LUFS. Applied only -22.9 dB gain, no limiter/compressor. Result: exactly -35.6 LUFS, -22.9 dBFS true peak, AAC-LC 48 kHz stereo, SHA-256 990a8787732a0df497a77491ee0a6d0f9b5676b174c8e048c90a543380906f14.
• Private ES drop-in now requires authenticated active EarlyBird membership and supports byte ranges.
• Real Chrome/WebBridge acceptance: intro advanced 7.65 s at readyState 4; Beacon advanced simultaneously to 46.98 s through hls.js/MSE, muted and readyState 4; no media error. Seeking intro to its end produced equal-power Beacon fade: observed volume 0.301 during the ramp and 1.0 after three seconds.
• Fixed Chromium false-positive native HLS support; Apple keeps native HLS, Chrome/Firefox use hls.js.
• Health: PostgreSQL, migration, Listener, origin, staging public readiness and production readiness all green.
• Rollback env snapshots retained at /etc/harmonic-beacon/earlybirds-preview.env.pre-019934d and .pre-f90e67b; prior Listener image 806fe9c remains available.

[nicoechaniz]

Release-candidate checkpoint: exact head f9950bf is deployed only to https://earlybirds-staging.harmonicbeacon.com. This closes the iOS capacity/prewarm lifecycle gap with a two-step claim/attach then synchronous play gesture, and invalidates/revalidates prepared sources across displacement, expiry and mobile resume. Evidence: 1,027 tests pass / 19 expected skips, TypeScript/lint/build green, all PR checks green, independent P0/P1 review APPROVE, staging health/canary/Free lifecycle green, real authenticated Chrome no-play media readiness green. Rollback: env snapshot /etc/harmonic-beacon/earlybirds-preview.env.pre-f9950bf and prior image 48d7395; retain preview DB. No production, real payment or event-audio path changed.

[nicoechaniz]

Audio-approved staging update at 9946379: published exact _2hs Beacon master as immutable beacon-luz-20260624-2hs-aac320-v2 and exact Amara Sol EN r1 master as private amara-sol-en-r1-approved-aac320-v1.m4a, both AAC-LC 320/48k/stereo with no gain processing. Measurements: Beacon -14.2 LUFS/-0.2 dBFS decoded peak; EN -11.2 LUFS/-0.4 dBFS. ES low-gain legacy intro is disabled. Added artifact allowlist/provenance/acceptance docs and fixed root-built artifact.json readability with a regression test. Local full suite: 1,044 pass/19 standard skips; stream 16/16; preview 21/21; observability 5/5. Staging smoke and decoded canary=1; production unchanged. GitHub hosted runners experienced action-download Service Unavailable on the prior commit; current-head checks had not been scheduled at the time of this comment.

[nicoechaniz]

Staging update — 2026-08-06

Deployed Listener candidate: c4819091a2ce215b5ddf7252f3295485259ee9c3 (harmonic-beacon/earlybirds-preview-listener:c481909) exclusively to earlybirds-staging.harmonicbeacon.com; production was not changed.

This slice adds truthful transport activity: intro is active only after its play() resolves, natural intro completion transfers activity to Beacon, and Stop clears both indicators immediately while preserving the existing fade. It also removes the separate “Private drop-ins” section, places the Warm-up and Master volume inside Beacon 24/7, and removes source-specific recorded/live-instrument wording from the EarlyBird UI. No codec, gain, timing, media artifact, lease, origin, or event audio path changed.

Evidence:

• full commit gate: 124 test files passed / 4 standard skipped; 1,042 tests passed / 19 standard skipped
• focused Listener/copy: 22/22; TypeScript, ESLint and production build passed
• preview smoke passed; image exact, health gitSha exact, healthy, zero restarts
• authenticated Chrome desktop + 390×844 inspection: both actions initially aria-pressed=false; no Private drop-ins/source-specific wording; Warm-up and both ranges are inside Beacon 24/7
• production health remained 200

Rollback env: /etc/harmonic-beacon/earlybirds-preview.env.pre-c481909; previous image 5edfe73 remains available. Physical listening remains the honest acoustic acceptance gate; automated Chrome on this host has a known media-element stall even with an unrelated synthetic MP3.

[nicoechaniz]

Provenance correction: the canonical full commit is c4819098803e27c805550f22e734fc08e58f7773 (the prior evidence comment had the correct short tag but an incorrect expanded SHA from a summarized handoff). The Listener image was rebuilt from the same release with the corrected build attestation; health now reports this exact canonical SHA, preview smoke passes, the container is healthy with zero restarts, and production remains 200. There was no code, media, audio, data, or behavior change in this correction.

[nicoechaniz]

Listener UI checkpoint published in 04e578b:

• replaces the MVP surface with the accepted mobile-first Harmonic Beacon / Listener journey;
• one contextual Listen/Stop action, remembered intro-vs-Beacon mode, pause/resume, real intro progress and Skip to Beacon;
• moves membership/provenance into the account menu and keeps staging diagnostics outside the primary experience;
• source-neutral public copy: no recording/live-instrument claim;
• leaves HLS, leases, codec, rates, channels, gain, fade constants and event audio untouched.

Evidence: 1,047 tests passed (19 skipped), full ESLint passed, TypeScript passed, production build passed. Public browser layout passed locally at 1440 and 390 in ES/EN with no horizontal overflow. Authenticated local browser coverage is pending the isolated DB-backed staging smoke; the local fixture DB was not running (ECONNREFUSED), not an application failure.

[nicoechaniz]

Staging acceptance update:

• Listener image deployed only to isolated staging: 04e578b5d4abc7b73f3ac782abb4dfc6fc70efa8;
• public health attests the exact SHA and expected preview schema;
• authenticated 390 px browser flow passed: intro → pause → resume → Skip to Beacon → Beacon → Stop (stopped);
• zero horizontal overflow and zero camera/microphone requests;
• preview DB, Listener, origin and migrations passed smoke; live event health stayed green and unchanged;
• rollback snapshot is root-only /etc/harmonic-beacon/earlybirds-preview.env.pre-04e578b, previous Listener release 0b186df.

Operational evidence is committed at branch head d2e5d88. Ready for human visual/listening review at https://earlybirds-staging.harmonicbeacon.com/.

[nicoechaniz]

Live-edge Listener refinement deployed to isolated staging at application SHA 2f057e0a31e384ba4d47cd14652afe1967c830ae:

• Beacon exposes Stop only; Pause/Seek are intro-only;
• subsequent Listen rejoins the configured live edge;
• removed persistent intro metadata, visible Beacon title and explanatory paragraph;
• compact 390x844 active state fits without scrolling;
• volume changes update media elements off the React render path;
• stability-first hls.js target: 5 segments behind edge, 60 s buffer target, 90 s hard max, low latency off (explicitly audio-approved by Nico);
• real browser remained playing after five rapid volume changes with 27.8 s buffered ahead;
• 1,049 tests, lint, TypeScript, build, frozen-audio-path and all CI checks green.

Rollback: root-only env snapshot .pre-2f057e0, prior Listener image 04e578b. Human listening confirmation of the reported choppiness is the remaining acceptance signal.

[nicoechaniz]

Public Free for All checkpoint — 2026-08-07

Published the isolated Listener at https://listen.harmonicbeacon.com with EARLY_BIRDS_FREE_FOR_ALL=1. This is a reversible access override, not a membership mutation.

Evidence:

• application image provenance: 5908ea00a551641bf2c9f362e9735b93568e82fa; infrastructure head: c2ea778;
• TLS valid; public vhost exposes only root, Next static assets, health, stream and configured drop-ins; auth, synthetic login, invitation, internal, event and staff routes return edge 404;
• anonymous lease, signed manifest and origin CORS passed;
• headless Chromium at 390x844: Beacon-only advanced to 20.58s with readyState 4, intro advanced to 3.53s with readyState 4, no media error, no unexpected network failures and no page scroll;
• 1,059 tests passed, lint/TypeScript/build passed, preview/origin contracts passed;
• normal-state copy and the Listener constellation were removed. Exceptional connecting/recovery/error state remains truthful;
• live.harmonicbeacon.com and the weekend stack were not modified.

Rollback / close public moment:

1. set EARLY_BIRDS_FREE_FOR_ALL=0 in the protected preview env;
2. recreate only the isolated Listener;
3. verify anonymous lease/manifest fails while signed-in membership access resumes. Existing signed/buffered media can drain for roughly the short manifest/signature horizon.

Product follow-ups:

• LISTENER-05 — Weekly Free listening quota and collaboration credits #214 tracks weekly-locked daily free windows;
• LISTENER-03 — Reactive cosmic campfire driven by the audible Beacon #212 now tracks the privacy-preserving cosmic campfire prototype and explicitly compares it against today’s blank MVP before shipping.

[nicoechaniz]

Listener language/audio follow-up deployed to isolated Free For All preview.

• commit: f6e57b0
• Spanish browser preference selects Spanish UI and Spanish Amara Sol intro
• every non-Spanish browser preference selects English UI and English intro
• removed the top language toggle from Listener
• the intro dropdown remains an explicit audio-only override
• 1,062 tests passed; focused lint and production build passed
• post-deploy health/readiness green; ES/EN server-rendered variants and ES media endpoint verified at https://listen.harmonicbeacon.com/

[nicoechaniz]

Fast-forward checkpoint deployed to the isolated Listener:

• SHA: d7ed952
• DB schema: 20260807070000_early_bird_free_schedule (forward-only migration)
• URL: https://listen.harmonicbeacon.com/
• FFA: restored to ON after the registered-Free smoke

Validated: 1,082 tests, lint, TypeScript, build, all PR checks, migration/health/readiness, nginx boundary, Google redirect to accounts.google.com, provider absence for unconfigured Apple, signed-in synthetic Free schedule and bounded HLS lease, anonymous FFA playback, ES/EN drop-ins.

Rollback snapshots on mona:

• /etc/harmonic-beacon/earlybirds-preview.env.pre-d7ed952
• /etc/nginx/sites-available/listen.harmonicbeacon.com.pre-d7ed952

Prior image f6e57b0 remains installed. Event/live stack and approved audio are unchanged.

[nicoechaniz]

Latest isolated Listener checkpoint: application 575b75a is deployed at https://listen.harmonicbeacon.com; branch/handoff head is a285ce7. Schema is 20260807070000_early_bird_free_schedule and FFA is ON. Google reaches the real account chooser with exact callback, state and PKCE; auth mutations require exact Origin; unconfigured Apple is absent; session IP/user-agent and provider tokens are not retained. Deployed registered-Free smoke now proves custom and Listen-now schedules, idempotent replay, seven-day cooldown, exact lease cap, oldest-device eviction and signed manifest. Synthetic logout, anonymous FFA, ES/EN ranges, health/readiness and decoded canary pass. Full local gate and current CI are green: 1,087 tests plus ESLint, TypeScript, build, frozen-audio, preview, origin and observability checks. Acceptance and complete evidence matrix live in docs/operations/EARLY_BIRDS_FREE_ACCEPTANCE.md and docs/operations/FOUNDING_LISTENER_RELEASE_CANDIDATE.md. Root-only rollback env is /etc/harmonic-beacon/earlybirds-preview.env.pre-575b75a; previous Listener images d7ed952 and f6e57b0 are retained.

[nicoechaniz]

Acceptance update (2026-08-07): a supervised human completed the real Google callback, logout and sign-in again. Sanitized persistence checks passed (OAuth tokens and session IP/user-agent absent); no identity data is recorded. A custom Free window selected one minute ahead became authorized and entered Listener after reload. The missing automatic boundary refresh is tracked conditionally in #216 pending confirmation of the recurring two-hour Free model. Apple remains hidden/fail-closed pending exact Developer Program artifacts. FFA is temporarily OFF for coordinated registered-Free physical acceptance and must be restored before anonymous public sharing.