Unify waitlist and Console with Auth0 and early-access control

[peacenode]

Summary

Consolidates #46 into this PR, now targeting main. Includes the waitlist port, provider-independent identity foundation, early-access approval, and Auth0-first joining. #46 is closed as superseded, not merged.

• /waitlist: Join and Sign in use Auth0; trusted verified identities link/enroll without marketing opt-in.
• Active database administrators land on /admin inside Console chrome; approved members land on /home; pending members see the waiting screen. Disabled/revoked status takes precedence.
• Admin roles, product approval, waitlist enrollment, newsletter consent, and external billing accounts remain separate domains.
• Legacy waitlist cookies no longer authorize sessions, consent, administration or CSV export. Legacy verification confirms the old enrollment only.
• Referrals survive the Auth0 return flow. Membership reads do not enroll ahead of referral context.
• Includes current-main CIMD support while preserving shared MCP/device/backend gates and single-use authorization codes.

Evidence

• 253 credential-free unit tests; 108 Console/MCP tests pass.
• Disposable Postgres: 11 access/enrollment/bulk/consent and 5 route tests pass; referral regression rerun after fix.
• Lint, typecheck and production build pass (existing Auth0 warnings).
• Independent exact-commit reviews: no new high/critical findings; SEC-05 referral finding fixed and re-reviewed at c18fc0f.
• Repository ledger: docs/early-access/build-ledger.md; architecture amendments: docs/early-access/architecture.md.

Preview and production hold

Protected isolated preview: https://console-git-codex-early-access-foundation-livepeer-foundation.vercel.app/waitlist

Draft intentionally retained. Live Auth0/admin/approved/pending acceptance and staging user-token compatibility are separate checks, not claimed from unit tests. SEC-02 (refresh-token hardening) and SEC-04 (inherited loopback redirect flexibility) remain production-hold decisions. Production grandfather inventory and secret reconciliation remain blocked; prior read-only dry-run evidence is retained.

No production migration, activation, merge, domain cutover, credential rotation or backlog processing. Resend remains delivery infrastructure; Better Auth is not installed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
console	Ready	Preview	Sep 5, 2026 12:08am UTC

[peacenode]

Final preview evidence — 91def27e13c6933b3183da49a3bea61b12138c76

GitHub signature VALID; Vercel READY (dpl_7c32A7TohBRZzdJbTGNKMr4TK4Zn); Validate Console CI passed. Working tree clean. No production change.

• 253 unit tests, 108 Console/MCP tests, lint, typecheck, and production build passed.
• Marked disposable Neon branch: 11 access/bulk/consent + 5 route + 16 identity + 1 migration integration tests passed. The route suite reran after SEC-05 and proves an authenticated membership read does not consume referral enrollment. No automated writes to shared user-test preview or production.
• Protected deployment smoke: waitlist 200; join 307 with referral/UTM intact; Auth0 307 to configured tenant; retired anonymous signup 410; anonymous Console session 401; admin API 403; admin CSV 404; public MCP discovery 200 with the preview resource URL.
• Browser verified updated waitlist CTAs and clicked Join through to the Auth0 login screen. User sign-in is the next acceptance action; no credential entry or account creation was performed by the agent.
• Independent reviewer closed SEC-05 at c18fc0f; no new critical/high finding. Existing SEC-02 and SEC-04 remain unresolved production holds, not accepted exceptions.

Remaining acceptance: actual Auth0 callback and pending screen; admin/approved landing with explicit preview fixtures; approve/revoke round-trip; live staging device/MCP user-token compatibility. Do not infer these from mocked or anonymous tests. Full grandfather inventory, production secrets and access-enforcing rollback also remain release gates.

Preview: https://console-git-codex-early-access-foundation-livepeer-foundation.vercel.app/waitlist