digital-archive: light up streaming — secrets, the flag, and the first bind --apply run

[jakebromberg]

Problem

The digital archive is fully built on both sides and dark. The iOS client shipped its player (WXYC/wxyc-dj-ios#135), the endpoint exists (#2320), the schema exists (#2318), and the bind job exists (#2319) — but nothing has been switched on, and no ticket tracks switching it on. That step has lived only in conversation, which is why it has survived several rounds of work unfiled.

Concretely, today:

• DIGITAL_ARCHIVE_STREAMING_ENABLED defaults false, so GET /digital-archive/albums/:libraryId/playback 403s unconditionally.
• The same flag drives the catalog export, so has_digital_audio ships false for every row — meaning no digital-audio badge renders anywhere in the iOS app, and the Play section is unreachable regardless of the endpoint.
• No DIGITAL_ARCHIVE_* secrets exist in the deploy environment.
• The bind job has never run --apply, so digital_asset / digital_asset_file hold no rows.

Net effect: the entire feature is inert end to end, and from the outside it is indistinguishable from not having been built.

Desired end state

A DJ (any role but member) opens an album the auto DJ has audio for, sees the digital-audio badge, and can play it.

What this involves

Rough shape, to be confirmed against the runbook at execution time:

1. Six repo secrets for the Spaces credentials the presigner needs. Use a read-only key — the Space is AzuraCast's live playout storage and every operation against it must be read-only. Never write, rename, or restructure anything in it.
2. Six set-ec2-env-var.yml runs to put them and the flag onto the instance.
3. The first bind --apply run, preceded by the human CSV review pass the job is designed around.
4. Flip DIGITAL_ARCHIVE_STREAMING_ENABLED and confirm the export's has_digital_audio reconciles.

Blocked by

• digital-archive: four one-way doors to settle before the first bind run writes rows #2338 — four one-way doors to settle before the first bind run writes rows. These are decisions that are expensive to reverse once rows exist; that is the whole reason this is sequenced after them.
• digital-archive-bind: the CSV review round trip fails silently in four ways a human reviewer will hit #2337 — the CSV review round trip fails silently in four ways a human reviewer will hit. Step 3 above is that round trip, so running it before this is fixed means a review pass that can silently lose corrections.

Constraints

• The Space is live playout storage. Read-only, always. A write against it is a production incident, not a bug.
• A presigned URL is a bearer credential until expires_at: never log one, never put one in an error payload, never paste one into an issue or PR.
• Prefer a narrow first bind run (a rotation-derived subset) over a full-catalog --apply, so the CSV review is a size a human can actually do and the first production rows are a set you can inspect.

Acceptance criteria

• Secrets present; no credential value in any log, PR, or issue.
• Bind run completed with its CSV review, and the resulting row count recorded here.
• DIGITAL_ARCHIVE_STREAMING_ENABLED on, endpoint returning a signed manifest for a bound album.
• has_digital_audio true for bound albums in the catalog export.
• Confirmed end to end from the iOS app: badge renders, Play section lists tracks, audio plays.

Related

• [Epic] In-app player for the auto-DJ archive (the digital archive's first consumer) wxyc-dj-ios#135 — the iOS client epic. This does not block that epic: the client work is complete and verifiable without the archive, and holding an iOS epic open on this repo's ops work would make it un-closeable for reasons the client can't influence. The dependency runs the other way — the feature is not usable until this lands.
• digital_asset manifest schema: store / asset / file / catalog_export_flag_state tables + library_watermark trigger and callable wrapper #2318, jobs/digital-archive-bind: inventory the AzuraCast media Space and bind albums to library.id (rotation-derived first, CSV review) #2319, GET /digital-archive/albums/:libraryId/playback: presigned manifest, digital_archive:listen grant, DIGITAL_ARCHIVE_STREAMING_ENABLED, has_digital_audio export column #2320 — the schema, the bind job, and the endpoint this switches on.
• Archive playback: verify the four device-only audio behaviours #145 shipped unverified wxyc-dj-ios#153 — the client's device-behaviour verification, deliberately independent of this and not waiting for it.