docs: fork direction — listener-first, composable roles, three-tier access

[midineutron]

What this is

A documentation-only proposal describing where this fork has taken Crate and the vision behind it. It adds nothing to the codebase — it's here to align on direction before sending the implementation as staged PRs.

If the direction is welcome, the work already done on the fork (below) follows as small, reviewable PRs.

The vision in one line

Artist-first, self-sovereign music streaming: if the artist holds the keys and the masters, the host becomes interchangeable — and on that guarantee you build a physical-tag access economy and curated, network-effect discovery.

What's included

Doc	What it covers
docs/PRD.md	Product vision, personas (everyone is a listener; artist/DJ/label are additive roles), requirements. NFC access via mycelium proof-of-tap (tag tech abstracted).
docs/ARCHITECTURE.md	How PRD, roadmap, and ADRs fit; layered model; the radio → member → owner access funnel; now-vs-later.
docs/ROADMAP.md	Milestones M0–M5 + mycelium/platform/distribution tracks, a dependency DAG, and a Progress section for what's shipped on the fork.
docs/adr/0001–0005	The load-bearing decisions (one per file).

Key decisions (ADRs)

• 0001 Storage source composition — local/USB/cloud as composable sources; portable by reference or by copy.
• 0002 Distribution & participant roles — universal listener identity + additive roles; content-addressed tracks; pull replication; metering at the entitlement-authority layer.
• 0003 Access membranes — radio (public, non-interactive) → member (tap a beacon) → owner (buy a keychain). Supersedes a flat preview/full model.
• 0004 Crate ↔ mycelium boundary — mycelium is an external, loose-coupled trust fabric (tag authenticity + identity); Crate owns resolution + entitlement; no in-cluster co-location assumption.
• 0005 Pluggable auth — crate-auth is a generic OAuth2/OIDC client; mycelium is one provider; discovery + ES256/RS256 + PKCE.

Already implemented on the fork (would follow as PRs if approved)

• Generic OAuth2/OIDC auth (mycelium decoupled as the only provider)
• CloudFront signed-cookie auth retained via an authMode switch (backwards compatible with this repo's current deployment)
• External provider addressing (no in-cluster DNS assumption)
• docker-compose local stack (docker compose up on a laptop; gated profile with no external IdP needed)

Note on internal consistency

The ADRs are decision records and intentionally show evolution: e.g. ADR 0003 supersedes the PRD §8.2 preview/full tiers with the radio/member/owner membranes, and ADR 0004/0005 reposition mycelium from "the moat" to an external provider. Happy to fold those revisions directly into the PRD body if preferred, or keep the ADRs as the authoritative record of the change.

Docs only — feedback on direction very welcome.

[midineutron]

Updated to the listener-first direction (ADR 0006): everyone is a listener; artist / DJ / broadcaster / label are composable roles; the three-tier access model (radio → member → owner, on NFC beacon/keychain tags) is a fundamental for every crate owner; the DJ is first-class (private keychain-gated collection as the cold-start wedge + public reference-mixes); and the mix is a first-class reference object (references, not copies). PRD, roadmap, architecture, and a new ADR 0006 are included.