feat(alpha): complete proof-of-play readiness program

.env.example

@@ -4,7 +4,9 @@
 DATABASE_URL=postgres://opencade:opencade@db:5432/opencade
 # Generate with: openssl rand -hex 32
 SESSION_SECRET=replace-with-at-least-32-random-bytes
-ALLOWED_ORIGINS=http://localhost:1420,tauri://localhost
+# Generate independently with: openssl rand -hex 32
+RELAY_AUTH_SECRET=replace-with-a-different-32-byte-random-secret
+ALLOWED_ORIGINS=http://localhost:1420,tauri://localhost,http://tauri.localhost,https://tauri.localhost
 OPENCADE_ENV=production
 
 # Optional overrides:
@@ -15,4 +17,4 @@ OPENCADE_ENV=production
 # POSTGRES_DB=opencade
 # RFC 8489 server as a numeric IP:port. Both variables should identify the same service.
 # OPENCADE_STUN_SERVER=203.0.113.10:3478
-# VITE_STUN_SERVER=203.0.113.10:3478
+# RELAY_URL=wss://relay.example.com/relay

.github/workflows/ci.yml

@@ -118,6 +118,7 @@ jobs:
         run: docker compose config
         env:
           SESSION_SECRET: ci-compose-secret-at-least-32-bytes
+          RELAY_AUTH_SECRET: ci-relay-secret-at-least-32-bytes-long
 
   desktop:
     name: Desktop Rust (Windows / MSRV)
@@ -149,15 +150,34 @@ jobs:
       - name: Build Windows LAN alpha tools
         run: cargo build -p opencade-networking --bins --release --locked
 
+      - name: Build Windows desktop alpha
+        run: cargo build --manifest-path apps/client/src-tauri/Cargo.toml --release --locked
+
+      - name: Package and verify Windows alpha kit
+        shell: pwsh
+        run: .\scripts\alpha\OpenCade-Alpha.ps1 -Mode Package -KitRoot alpha-kit
+
+      - name: Alpha kit verifier rejects tampering
+        shell: pwsh
+        run: |
+          Copy-Item alpha-kit alpha-kit-tampered -Recurse
+          Add-Content -LiteralPath alpha-kit-tampered\opencade-client.exe -Value "tampered"
+          $failedClosed = $false
+          try {
+            .\scripts\alpha\OpenCade-Alpha.ps1 -Mode Verify -KitRoot alpha-kit-tampered
+          } catch {
+            $failedClosed = $true
+          }
+          if (-not $failedClosed) {
+            throw "Alpha kit verifier accepted a tampered executable"
+          }
+
       - name: Upload Windows LAN alpha tools
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         uses: actions/upload-artifact@v4
         with:
-          name: opencade-lan-tools-windows
-          path: |
-            target/release/opencade-match-probe.exe
-            target/release/opencade-match-verify.exe
-            target/release/opencade-alpha-summary.exe
+          name: opencade-windows-alpha
+          path: alpha-kit
           if-no-files-found: error
           retention-days: 14
 

.gitignore

@@ -37,6 +37,8 @@ apps/client/src-tauri/target/
 apps/client/src-tauri/gen/schemas/
 apps/client/dist/
 apps/client/bundle/
+/alpha-kit/
+/alpha-kit-tampered/
 
 # ── Environment / Secrets ────────────────────────────────────
 .env

CONTRIBUTING.md

@@ -88,7 +88,7 @@ opencade/
 │   ├── fbneo/             # FBNeo adapter (first adapter)
 │   └── mame/              # (future)
 ├── services/
-│   └── relay/             # opencade-relay (TURN-like fallback)
+│   └── relay/             # authenticated readiness-probe WebSocket fallback
 ├── research/              # NOT SHIPPED — observations only (see GUARDRAILS.md)
 ├── docs/
 ├── docker/