draft: build isolated Founding Listener candidate

.env.example

@@ -44,6 +44,82 @@ BEACON_COMMERCE_SERVICE_KEY_CURRENT=replace-with-at-least-43-random-characters
 # Fixed at seven days for the 2026-08-08 event plus support window.
 SESSION_COOKIE_TTL_SECONDS=604800
 
+# ===================
+# Listener identity, membership and private stream
+# ===================
+# Identity/access settings below keep their EARLY_BIRDS_ deployment names for
+# the existing namespace migration. The application also accepts the stable
+# BEACON_LISTENER_ alias for ENABLED, FREE_FOR_ALL, AUTH_BASE_URL,
+# TRUSTED_ORIGINS, AUTH_SECRET, Google credentials, the magic-link trio,
+# test access and staging team entry. Never mix generations within a credential
+# bundle; if both aliases are present they must have the same trimmed value.
+# Public entry defaults OFF. Set to exactly 1 only after the isolated stack is
+# healthy; switching it back to 0 presents a truthful unavailable page while
+# private membership projection and reconciliation continue.
+EARLY_BIRDS_ENABLED=0
+# Reversible operator override for public listening moments. Exactly 1 bypasses
+# identity/membership only for Listener audio routes; 0 restores normal access.
+EARLY_BIRDS_FREE_FOR_ALL=0
+
+# Public app origin. Register these exact OAuth callbacks:
+#   https://<app-host>/api/early-birds/auth/callback/google
+#   https://<app-host>/api/early-birds/auth/callback/apple
+EARLY_BIRDS_AUTH_BASE_URL=https://app.example.invalid
+EARLY_BIRDS_TRUSTED_ORIGINS=https://app.example.invalid
+EARLY_BIRDS_AUTH_SECRET=replace-with-at-least-32-random-characters
+EARLY_BIRDS_GOOGLE_CLIENT_ID=
+EARLY_BIRDS_GOOGLE_CLIENT_SECRET=
+# Apple remains absent from the UI until the complete server-side bundle is
+# installed and this explicit gate is exactly 1.
+BEACON_LISTENER_APPLE_ENABLED=0
+BEACON_LISTENER_APPLE_CLIENT_ID=
+# Generated ES256 Apple client-secret JWT. Never place the private .p8 here.
+BEACON_LISTENER_APPLE_CLIENT_SECRET=
+
+# Optional passwordless fallback. The UI and Better Auth plugin remain absent
+# unless all three values are complete. Delivery is a narrow private API owned
+# by the existing mail service; never mount its Gmail grant into this app.
+EARLY_BIRDS_MAGIC_LINK_DELIVERY_URL=
+EARLY_BIRDS_MAGIC_LINK_DELIVERY_TOKEN=
+EARLY_BIRDS_MAGIC_LINK_RATE_SECRET=
+
+# Outbound server-to-server access to PMP Myth Bot, the sole membership authority.
+EARLY_BIRDS_AUTHORITY_BASE_URL=http://pmp-myth-bot:3000
+EARLY_BIRDS_AUTHORITY_SERVICE_KEY_ID=local-v1
+EARLY_BIRDS_AUTHORITY_SERVICE_TOKEN=replace-with-at-least-43-random-characters
+
+# Inbound monotonic membership projection authentication; keep current and
+# previous simultaneously during a rotation.
+EARLY_BIRDS_BEACON_SERVICE_KEY_CURRENT_ID=local-v1
+EARLY_BIRDS_BEACON_SERVICE_KEY_CURRENT=replace-with-at-least-43-random-characters
+# EARLY_BIRDS_BEACON_SERVICE_KEY_PREVIOUS_ID=
+# EARLY_BIRDS_BEACON_SERVICE_KEY_PREVIOUS=
+
+# The browser receives only a stable same-origin manifest URL. These credentials
+# remain server-side and sign the approved origin artifact for <=10 minutes.
+EARLY_BIRDS_STREAM_ORIGIN=https://stream.example.invalid
+EARLY_BIRDS_STREAM_ARTIFACT_ID=approved-v1
+EARLY_BIRDS_STREAM_SIGNING_SECRET=replace-with-at-least-32-random-characters
+EARLY_BIRDS_DEVICE_PEPPER=replace-with-at-least-32-random-characters
+# Private drop-ins are local files served through the authenticated same-origin route.
+# Leave either absolute path empty to fail closed for that language.
+EARLY_BIRDS_DROPIN_ES_PATH=
+EARLY_BIRDS_DROPIN_EN_PATH=
+
+# Synthetic auth/access is absent unless BOTH values are explicitly present.
+# The harness must call POST /api/early-birds/test-login with
+# Authorization: Bearer <this secret>. Never expose it to browser code or production.
+EARLY_BIRDS_TEST_ACCESS_ENABLED=0
+# EARLY_BIRDS_TEST_LOGIN_SECRET=replace-with-at-least-32-random-characters
+
+# Optional human-operated synthetic entry for HTTPS staging only. It remains
+# hidden unless all EarlyBird/test gates above and this dedicated gate are 1,
+# NODE_ENV is production, X-Forwarded-Proto is exactly https, and Host exactly
+# matches one comma-separated entry below. Values are host[:port], never URLs
+# or wildcards. Do not include production/customer hosts.
+EARLY_BIRDS_STAGING_TEAM_ENTRY_ENABLED=0
+# EARLY_BIRDS_STAGING_TEAM_ENTRY_HOSTS=earlybirds-staging.example.invalid
+
 # Trusted reverse-proxy hops in front of the app, used to find the real client
 # address for the failed-login limiter. 1 = Nginx only; 2 = Cloudflare + Nginx.
 # Too high a value keys the limiter on a forgeable header; too low keys every

.github/workflows/ci.yml

@@ -22,7 +22,7 @@ jobs:
       - run: npm ci
       - name: Reject high-severity production dependency regressions
         run: |
-          npm audit --omit=dev --audit-level=high
+          npm run audit:production
           npm audit --omit=dev --prefix services/tapestry --audit-level=high
           npm audit --omit=dev --prefix services/playlist-bot --audit-level=high
       - run: npm run lint

.github/workflows/deploy.yml

@@ -46,7 +46,7 @@ jobs:
           npm run contract:commerce:verify
           npm test
           npm test --prefix services/tapestry
-          npm audit --omit=dev --audit-level=high
+          npm run audit:production
           npm audit --omit=dev --prefix services/tapestry --audit-level=high
           npm audit --omit=dev --prefix services/playlist-bot --audit-level=high
           npx tsc --noEmit

.github/workflows/e2e.yml

@@ -146,12 +146,31 @@ jobs:
       - name: Run Firefox functional and accessibility gates
         run: npx playwright test --project=firefox
 
+      - name: Verify Listener Founder and Free account-switch cache boundary
+        run: >-
+          npx playwright test e2e/tests/listener-account-switch.spec.ts
+          --project=chromium
+          --project=firefox
+        env:
+          E2E_LISTENER_ACCOUNT_SWITCH_GATE: '1'
+
       - name: Install WebKit after Chromium screenshot gates
         run: npx playwright install --with-deps webkit
 
       - name: Run iPhone/WebKit media gate
         run: npx playwright test e2e/tests/media-continuity.spec.ts --project=iphone-webkit
 
+      - name: Verify Listener buffer and recovery under deterministic network loss
+        run: >-
+          npx playwright test e2e/tests/listener-network-resilience.spec.ts
+          --project=chromium
+          --project=firefox
+          --project=android-chrome
+          --project=iphone-webkit
+          --workers=4
+        env:
+          E2E_LISTENER_NETWORK_GATE: '1'
+
       - name: Verify commerce transaction and durable outbox contract
         run: npx vitest run --no-file-parallelism src/lib/__tests__/commerce-entitlement.integration.test.ts src/lib/__tests__/promo-invitation.integration.test.ts
         env:

.github/workflows/early-birds-fast-forward.yml

@@ -0,0 +1,242 @@
+name: EarlyBirds fast-forward checks
+
+on:
+  pull_request:
+    paths:
+      - Dockerfile
+      - package.json
+      - package-lock.json
+      - prisma/**
+      - src/app/api/health/**
+      - src/app/api/early-birds/**
+      - src/app/api/listener/**
+      - src/app/early-birds/**
+      - src/app/listener/**
+      - src/components/early-birds/**
+      - src/lib/early-birds/**
+      - src/lib/listener/**
+      - e2e/fixtures/listener-account-switch.ts
+      - e2e/tests/listener-account-switch.spec.ts
+      - e2e/tests/listener-network-resilience.spec.ts
+      - playwright.config.ts
+      - src/app/layout.tsx
+      - src/app/globals.css
+      - src/components/brand/ListenerIdentityCacheBoundary.tsx
+      - src/components/brand/__tests__/ListenerIdentityCacheBoundary.test.tsx
+      - services/beacon-stream/**
+      - ops/early-birds/**
+      - ops/early-birds-preview/**
+      - ops/beacon-account/**
+      - ops/listener-identity-staging/**
+      - ops/listener-account-production/**
+      - scripts/beacon-account/**
+      - scripts/early-birds-preview/**
+      - scripts/listener-identity-staging/**
+      - scripts/listener-account-production/**
+      - scripts/listener_container_observer.py
+      - tools/early-birds-hls-load/**
+      - docs/ops/LISTENER_FIRST_EXTERNAL_HLS_SMOKE.md
+      - docs/operations/EARLY_BIRDS_STAGING_PREVIEW.md
+      - docs/operations/FOUNDING_LISTENER_COMMERCIAL_LAUNCH.md
+      - docs/operations/LISTENER_LAUNCH_NOW.md
+      - docs/operations/LISTENER_PRIVATE_LIVE_WORKBENCH.md
+      - .github/workflows/early-birds-fast-forward.yml
+  push:
+    branches: [early-birds, "feat/early-birds-*"]
+    paths:
+      - Dockerfile
+      - package.json
+      - package-lock.json
+      - prisma/**
+      - src/app/api/health/**
+      - src/app/api/early-birds/**
+      - src/app/api/listener/**
+      - src/app/early-birds/**
+      - src/app/listener/**
+      - src/components/early-birds/**
+      - src/lib/early-birds/**
+      - src/lib/listener/**
+      - e2e/fixtures/listener-account-switch.ts
+      - e2e/tests/listener-account-switch.spec.ts
+      - e2e/tests/listener-network-resilience.spec.ts
+      - playwright.config.ts
+      - src/app/layout.tsx
+      - src/app/globals.css
+      - src/components/brand/ListenerIdentityCacheBoundary.tsx
+      - src/components/brand/__tests__/ListenerIdentityCacheBoundary.test.tsx
+      - services/beacon-stream/**
+      - ops/early-birds/**
+      - ops/early-birds-preview/**
+      - ops/beacon-account/**
+      - ops/listener-identity-staging/**
+      - ops/listener-account-production/**
+      - scripts/beacon-account/**
+      - scripts/early-birds-preview/**
+      - scripts/listener-identity-staging/**
+      - scripts/listener-account-production/**
+      - scripts/listener_container_observer.py
+      - tools/early-birds-hls-load/**
+      - docs/ops/LISTENER_FIRST_EXTERNAL_HLS_SMOKE.md
+      - docs/operations/EARLY_BIRDS_STAGING_PREVIEW.md
+      - docs/operations/FOUNDING_LISTENER_COMMERCIAL_LAUNCH.md
+      - docs/operations/LISTENER_LAUNCH_NOW.md
+      - docs/operations/LISTENER_PRIVATE_LIVE_WORKBENCH.md
+      - .github/workflows/early-birds-fast-forward.yml
+
+permissions:
+  contents: read
+
+jobs:
+  quota-postgres:
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_PASSWORD: listener_test
+          POSTGRES_DB: listener_test
+        ports:
+          - 55433:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres -d listener_test"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 12
+    env:
+      DATABASE_URL: postgresql://postgres:listener_test@localhost:55433/listener_test
+      LISTENER_TEST_DATABASE_URL: postgresql://postgres:listener_test@localhost:55433/listener_test
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22.22'
+          cache: 'npm'
+      - run: npm ci
+      - run: npx prisma migrate deploy
+      - run: npm test -- --run src/lib/early-birds/__tests__/founder-eligibility.postgres.test.ts src/lib/early-birds/__tests__/quota.postgres.test.ts
+
+  stream-origin:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: services/beacon-stream
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: 22 }
+      - run: npm test
+      - run: npm run check
+
+  observability-config:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ops/early-birds
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: 22 }
+      - uses: actions/setup-python@v5
+        with: { python-version: '3.13' }
+      - run: npm test
+      - run: npm run check
+      - run: npm run validate
+      - run: npm --prefix ../../tools/early-birds-hls-load test
+      - run: npm --prefix ../../tools/early-birds-hls-load run check
+
+  staging-preview:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: 22 }
+      - run: npm --prefix ops/early-birds-preview run check
+      - run: npm --prefix ops/early-birds-preview test
+      - run: npm --prefix ops/early-birds-preview run validate:build
+      - run: npm --prefix ops/listener-identity-staging run check
+      - run: npm --prefix ops/listener-identity-staging test
+      - run: npm --prefix ops/listener-identity-staging run validate:example
+      - run: npm --prefix ops/listener-account-production run check
+      - run: npm --prefix ops/listener-account-production test
+
+  identity-cache:
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_PASSWORD: e2e
+          POSTGRES_DB: beacon_test
+        ports:
+          - 55432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres -d beacon_test"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 12
+    env:
+      E2E_DATABASE_URL: postgresql://postgres:e2e@localhost:55432/beacon_test
+      E2E_LISTENER_ACCOUNT_SWITCH_GATE: '1'
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22.22'
+          cache: 'npm'
+      - run: npm ci
+      - run: DATABASE_URL="$E2E_DATABASE_URL" npx prisma migrate deploy
+      - run: npx playwright install --with-deps chromium firefox
+      - run: >-
+          npx playwright test e2e/tests/listener-account-switch.spec.ts
+          --project=chromium
+          --project=firefox
+
+  network-resilience:
+    name: network-resilience (${{ matrix.project }})
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - project: chromium
+            browser: chromium
+            runner: ubuntu-latest
+          - project: firefox
+            browser: firefox
+            # Playwright documents that media codec availability varies by
+            # host OS. Its patched Linux Firefox does not expose the approved
+            # AAC/fMP4 MSE pipeline, so exercise Firefox on macOS rather than
+            # silently substituting a different stream codec.
+            runner: macos-15
+          - project: android-chrome
+            browser: chromium
+            runner: ubuntu-latest
+          - project: iphone-webkit
+            browser: webkit
+            runner: ubuntu-latest
+    env:
+      E2E_LISTENER_NETWORK_GATE: '1'
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22.22'
+          cache: 'npm'
+      - run: npm ci
+      - run: npx playwright install --with-deps ${{ matrix.browser }}
+      - name: Install deterministic HLS fixture encoder
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends ffmpeg
+          ffmpeg -version | head -n 1
+      - name: Install deterministic HLS fixture encoder on macOS
+        if: runner.os == 'macOS'
+        run: |
+          command -v ffmpeg >/dev/null || brew install ffmpeg
+          ffmpeg -version | head -n 1
+      - name: Run network resilience in an isolated browser process
+        run: >-
+          npx playwright test e2e/tests/listener-network-resilience.spec.ts
+          --project=${{ matrix.project }}
+          --workers=1

.gitignore

@@ -16,6 +16,9 @@
 /playwright-report/
 /e2e/.auth/
 /artifacts/load-test/
+/artifacts/early-birds-hls-load/
+__pycache__/
+*.py[cod]
 
 # next.js
 /.next/