Document Bifrost transport jurisdiction

AGENTS.md

@@ -3,7 +3,9 @@
 ## Repo Purpose
 
 - Bifrost is the GameCult member alpha platform for tasks, governance, contributor accounting, and operational legibility.
+- Bifrost also owns GameCult public-protocol transport for governed work crossings: GitHub proposal/review surfaces, Discord dispatch receipts, CultNet/CultCache intake packets, and future collaboration interfaces.
 - It sits under the Yggdrasil infrastructure umbrella and should connect GameCult services and workflows without importing crypto ideology or platform theater.
+- The transport role follows from Bifrost's government role. Do not treat bridge tools as a stray bot utility owned by VoidBot or individual repo Faces.
 
 ## V1 Non-Goals
 
@@ -47,9 +49,11 @@
 ## Working Notes
 
 - Read existing docs before reopening settled product decisions.
+- Treat `docs/jurisdiction-map.md` as the ownership map for Bifrost's bridge/governance/auth boundaries.
 - Keep implementation boring where possible; the product idea is ambitious enough already.
 - Push changes after every implementation pass.
 - If a question is about trust, accountability, or payout fairness, prefer auditability over automation.
+- If a question is about public work crossing GitHub, Discord, CultNet/CultCache intake, or future collaboration surfaces, prefer Bifrost-owned requests, receipts, and routing over local helper sprawl.
 - Before debugging UI/layout, inspect the live DOM and computed styles instead of guessing from templates or CSS intent.
 
 ## Starting Point For The Next Session
@@ -58,9 +62,12 @@ Read these files first:
 
 1. `AGENTS.md`
 2. `README.md`
-3. `docs/bifrost-mvp-plan.md`
-4. `docs/full-implementation-strategy.md`
-5. `docs/context.md`
+3. `docs/jurisdiction-map.md`
+4. `docs/bridge.md`
+5. `docs/agent-transport.md`
+6. `docs/bifrost-mvp-plan.md`
+7. `docs/full-implementation-strategy.md`
+8. `docs/context.md`
 
 Then start the first implementation milestone:
 

README.md

@@ -1,6 +1,8 @@
 # Bifrost
 
-Bifrost is the planned GameCult member, governance, and labor platform running under the Yggdrasil infrastructure umbrella. It exists to connect projects, contributors, motions, ledgers, and operational decisions in one place instead of leaving them scattered across GitHub, docs, chat, and human memory.
+Bifrost is the planned GameCult member, governance, labor, and public-process platform running under the Yggdrasil infrastructure umbrella. It exists to connect projects, contributors, motions, ledgers, work requests, public receipts, and operational decisions in one place instead of leaving them scattered across GitHub, docs, chat, and human memory.
+
+Bifrost also owns the governed transport layer for GameCult work that crosses public or collaboration protocols: GitHub proposal/review surfaces, Discord dispatch receipts, CultNet/CultCache intake packets, and future collaboration interfaces. That bridge role follows from the governance role; it is not a separate bot utility. See [docs/jurisdiction-map.md](E:\Projects\Bifrost\docs\jurisdiction-map.md).
 
 ## Status
 
@@ -15,6 +17,7 @@ This repository now includes a viable alpha foundation slice of the ASP.NET Core
 - health and readiness endpoints plus startup config validation
 - GitHub App webhook ingestion for issue, pull request, and review sync
 - local bridge tooling for agent-owned GitHub draft PRs and Discord posts
+- CultCache/CultNet-backed agent intake tooling for repo Face update requests
 - Docker image and local Compose stack for containerized smoke testing
 - xUnit integration tests under `tests/Bifrost.Web.Tests`
 - matching deploy artifacts and runbooks in `E:\Projects\gamecult-ops`
@@ -72,5 +75,8 @@ Before implementation work starts in a new session, read these files in order:
 
 1. [AGENTS.md](E:\Projects\Bifrost\AGENTS.md)
 2. [docs/bifrost-mvp-plan.md](E:\Projects\Bifrost\docs\bifrost-mvp-plan.md)
-3. [docs/full-implementation-strategy.md](E:\Projects\Bifrost\docs\full-implementation-strategy.md)
-4. [docs/context.md](E:\Projects\Bifrost\docs\context.md)
+3. [docs/jurisdiction-map.md](E:\Projects\Bifrost\docs\jurisdiction-map.md)
+4. [docs/bridge.md](E:\Projects\Bifrost\docs\bridge.md)
+5. [docs/agent-transport.md](E:\Projects\Bifrost\docs\agent-transport.md)
+6. [docs/full-implementation-strategy.md](E:\Projects\Bifrost\docs\full-implementation-strategy.md)
+7. [docs/context.md](E:\Projects\Bifrost\docs\context.md)

docs/agent-transport.md

@@ -1,6 +1,6 @@
 # Agent Transport
 
-Bifrost owns the agent transport contract for GameCult work requests.
+Bifrost owns the agent transport contract for GameCult work requests because agent intake is part of Bifrost's public-process jurisdiction. The broader ownership rule lives in `docs/jurisdiction-map.md`: Bifrost governs work crossings; CultCache stores typed packets; CultNet moves them; VoidBot observes Discord and packages consensus; repo Faces claim only work inside their jurisdiction.
 
 This is not a Postgres queue and not a VoidBot side channel. VoidBot may observe Discord and package consensus, but the shared request lane belongs here:
 
@@ -11,6 +11,14 @@ This is not a Postgres queue and not a VoidBot side channel. VoidBot may observe
 
 That ownership split matters. If the queue lives in VoidBot, Discord becomes the hidden source of authority. If it lives in Bifrost but stores through Entity Framework, agents cannot share the same packet through the CultCache/CultNet machinery they already use for state. The coherent machine is smaller: Bifrost says what the request means; CultCache remembers it; CultNet moves it.
 
+An update request is not just a message in a queue. It is a governed handoff:
+
+- what changed in the room, repo, motion, or work context
+- which repo or Face has jurisdiction
+- why this deserves priority now
+- where the claimed work should report back
+- which receipt will prove the request was handled
+
 ## Document
 
 Agent update requests are stored as CultCache documents with this type:
@@ -85,3 +93,4 @@ The plugin is listed in `.agents/plugins/marketplace.json` as `bifrost-intake`.
 
 - Route claimed agent work that produces reviewable artifacts through `tools/bifrost-bridge.mjs` so Bifrost, not VoidBot, owns GitHub and Discord crossing receipts.
 - Use CultNet direct pipes when a long-running agent runtime is available; keep raw snapshot files as the dead-simple bridge until then.
+- Surface transport requests inside the Bifrost app as governance/workflow objects instead of leaving them as local CLI state forever.

docs/bridge.md

@@ -1,6 +1,10 @@
 # Bifrost Bridge
 
-Bifrost is the bridge for GameCult agent work that needs to cross into GitHub, Discord, or another governed external surface.
+Bifrost is the bridge for GameCult agent and member work that needs to cross into GitHub, Discord, CultNet/CultCache intake, or another governed external surface.
+
+This is not a new side mission. Bifrost was already the member, governance, and labor platform: the place where GameCult work, motions, contributor accountability, and operational decisions become legible. Public-protocol transport belongs here because public work needs the same governance spine. The bridge is how Bifrost's government role touches GitHub, Discord, and future collaboration interfaces without letting VoidBot, repo Faces, or one-off helper scripts become hidden authorities.
+
+For the full ownership map, read `docs/jurisdiction-map.md`.
 
 That means Bifrost owns the operational meaning of the crossing:
 
@@ -15,10 +19,11 @@ It does not mean Bifrost should own OAuth sludge. Heimdall owns OAuth, linked id
 ## Ownership
 
 - Heimdall owns provider OAuth and account-linked credentials.
-- Bifrost owns bridge action policy, routing, execution receipts, and governance transport.
-- VoidBot observes Discord, packages conversation, and speaks through registered personas. It should not be the durable authority that mutates GitHub.
+- Bifrost owns bridge action policy, request lifecycle, routing, execution receipts, and governance transport.
+- VoidBot observes Discord, packages conversation, validates registered Face intent, and speaks through registered personas. It should not be the durable authority that mutates GitHub or owns public work transport.
 - CultCache stores lightweight agent transport packets when the bridge needs file-native state.
 - CultNet carries those packets between runtimes.
+- Repo Faces generate jurisdictional proposals and authored voice; they may request crossings, but they do not own the bridge.
 
 ## Local Bridge CLI
 

docs/context.md

@@ -2,7 +2,9 @@
 
 ## Why Bifrost Exists
 
-GameCult needs a platform that can connect public projects, contributor participation, governance, and internal accounting without relying on chat memory, disconnected tools, or hand-maintained spreadsheets of dubious destiny. Bifrost is that connective layer.
+GameCult needs a platform that can connect public projects, contributor participation, governance, agent work requests, public transport receipts, and internal accounting without relying on chat memory, disconnected tools, or hand-maintained spreadsheets of dubious destiny. Bifrost is that connective layer.
+
+Bifrost's bridge role follows from that purpose. GitHub proposals, Discord dispatch receipts, CultNet/CultCache intake packets, and future collaboration interfaces are not side channels when they carry GameCult work. They are public-process crossings, so Bifrost owns their request shape, routing, policy, audit, and receipt semantics. The detailed boundary map lives in `docs/jurisdiction-map.md`.
 
 ## Relationship To Other Workspaces
 
@@ -13,6 +15,15 @@ GameCult needs a platform that can connect public projects, contributor particip
 - `E:\Projects\gamecult-ops`
   - source of deployment and infrastructure conventions
   - documents Yggdrasil, nginx, systemd, and local-Postgres patterns
+- `E:\Projects\Heimdall`
+  - owns OAuth, linked accounts, token custody, signed claims, grants, consent, and revocation
+  - Bifrost consumes Heimdall identity/capability facts instead of becoming the credential vault
+- `E:\Projects\VoidBot`
+  - observes Discord, packages consensus, and runs repo Face heartbeats
+  - should call Bifrost for governed GitHub/Discord/intake crossings instead of becoming hidden transport authority
+- `E:\Projects\CultLib`
+  - stewards CultCache, CultNet, CultMesh, typed persistence, schemas, and reusable sync/storage libraries
+  - Bifrost defines the meaning of agent transport packets while CultLib-provided primitives store and move them
 - `Yggdrasil`
   - GameCult infrastructure host
   - intended deployment home for `bifrost.gamecult.org`

docs/jurisdiction-map.md

@@ -0,0 +1,142 @@
+# Bifrost Jurisdiction Map
+
+Bifrost is GameCult's government, labor, and public-process platform. Its bridge role is not a second mission stapled onto the side; it follows from the original mission. Work, motions, contributor accountability, review artifacts, and public commitments already need one official crossing between GameCult internals and the outside surfaces where work is argued or recorded.
+
+The agent swarm makes that need louder. Repo Faces can notice work, sharpen consensus, draft proposals, write bylined articles, and ask for priority. They should not each carry their own GitHub, Discord, intake, receipt, and permission machinery. That would turn every Face into a tiny foreign ministry with a shell script addiction. Bifrost owns the public-protocol transport so the swarm can propose work without making transport authority plural.
+
+## Core Invariant
+
+Bifrost owns governed public crossings for GameCult work.
+
+A governed public crossing is any action where an internal GameCult actor, agent, Face, or process causes a durable or visible change on a public or collaboration surface:
+
+- GitHub draft PRs, PR comments, issues, review artifacts, and work links
+- Discord persona announcements, dispatch receipts, and role-addressed work updates
+- CultNet/CultCache intake packets that move work requests between runtimes
+- future collaboration interfaces that expose GameCult decisions, requests, work status, or receipts outside a single local process
+
+Bifrost does not own every byte that moves. It owns the meaning, policy, routing, audit, and receipt of the crossing.
+
+## Why This Belongs To Bifrost
+
+Bifrost was already the member alpha platform for tasks, governance, contributor accounting, and operational legibility. GitHub integration was part of that from the start because GameCult work lives partly in GitHub issues, PRs, and review history. Discord integration becomes part of the same authority once agents and humans coordinate public work there.
+
+The bridge role is therefore an extension of Bifrost's government role:
+
+- tasks need a canonical relationship to GitHub and internal work items
+- proposals need a durable review surface instead of dissolving into chat
+- motions and priority disputes need receipts, provenance, and accountable closure
+- contributors and agents need one place to see what was requested, who claimed it, what crossed, and where it landed
+
+If the bridge lives in VoidBot, Discord becomes a hidden government. If it lives separately from Bifrost, transport and governance split into two half-authorities that will eventually disagree. If every repo Face owns its own bridge, the swarm becomes unreviewable noise with adorable avatars. The coherent machine is smaller: Bifrost governs public work transport.
+
+## Ownership Boundaries
+
+### Bifrost Owns
+
+- bridge action request shape and lifecycle
+- work-priority intake packets and claim semantics
+- mapping from internal request to public target surface
+- GitHub proposal/comment/PR transport for agent and member work
+- Discord dispatch receipts and persona announcements for work crossings
+- public receipt quality: target, actor, action, result, and next place to look
+- policy for which bridge actions are allowed in the Bifrost domain
+- audit records proving when a crossing was requested, claimed, executed, failed, or closed
+
+### Heimdall Owns
+
+- OAuth provider flows
+- account linking
+- credential custody
+- signed identity and capability claims
+- grants, consent, revocation, and capability evaluation
+
+Bifrost consumes Heimdall claims. It does not become the key vault. The split is bridge versus gate: Heimdall decides who may cross under which grant; Bifrost moves authorized work across public protocols and records where it landed.
+
+### VoidBot Owns
+
+- Discord observation and room context
+- archival retrieval and source/lore search surfaces
+- packaging recent chat consensus into a task packet
+- repo Face heartbeat prompts and local personality/state loops
+- the worker-side validation that a registered Face is allowed to request a crossing
+
+VoidBot should not be the durable authority that mutates GitHub or owns public work transport. It may prepare packets and call Bifrost. It does not get to be a shadow legislature because it was nearest to the chat log.
+
+### CultCache, CultNet, And CultLib Own
+
+- storage primitives
+- portable typed documents
+- sync protocol mechanics
+- schema and library support
+
+Bifrost defines what an agent transport request means. CultCache stores it. CultNet moves it. CultLib stewards the reusable infrastructure. Storage and sync do not decide governance semantics.
+
+### Repo Faces Own
+
+- repo-local attention, taste, and proposals
+- character/authored voice
+- repo-local state, rumination, maps, and bylined essays
+- asking for consensus where canon or implementation authority requires it
+
+Repo Faces may generate bridge requests. They do not own the bridge itself.
+
+## Concern Map
+
+| Concern | Owner | Reason |
+| --- | --- | --- |
+| Who is this actor? | Heimdall | Identity and account custody must stay with the auth authority. |
+| Is this actor allowed to request this crossing? | Heimdall plus Bifrost | Heimdall issues grants; Bifrost applies bridge-domain policy. |
+| What work is being requested? | Bifrost | The request shape, priority, provenance, and lifecycle are governance concerns. |
+| Where is the durable argument surface? | Bifrost | Public process must land on the correct GitHub, Discord, or future collaboration surface. |
+| What did the room recently agree or ask for? | VoidBot | Discord observation and consensus packaging belong to the room-aware bot. |
+| What does the repo Face think should happen? | Repo Face | Jurisdictional taste and proposal pressure belong to the Face. |
+| Where is the packet stored and synced? | CultCache/CultNet | Transport state should use the shared typed storage/sync substrate. |
+| What proves the action happened? | Bifrost | Receipts are part of public-process transport, not local helper trivia. |
+
+## Bridge Action Contract
+
+Every Bifrost-owned crossing should be able to answer:
+
+- actor: which member, agent, Face, app, or service requested the action
+- authority: what grant, review state, or policy allowed it
+- source: which chat, motion, work item, consensus packet, or repo state produced it
+- target: which repo, PR, issue, channel, thread, or interface receives it
+- action: what visible or durable change is being made
+- result: success, failure, queued, cancelled, or completed
+- receipt: the URL, message id, PR number, branch, request id, log path, or other concrete proof
+- next handoff: where humans and agents should continue the argument or review
+
+If a bridge action cannot name those fields, it is not ready to cross. Vague packet names and debug dumps in public channels are not cute; they are jurisdiction leaking out of a cracked pipe.
+
+## Current Local Implementation
+
+The current bridge is deliberately local and boring while Heimdall's managed credential runtime matures:
+
+- `tools/bifrost-bridge.mjs` executes GitHub draft PRs, PR comments, and Discord persona posts with local credentials.
+- `tools/agent-transport.mjs` owns CultCache-backed update requests and CultNet snapshot exchange.
+- `plugins/bifrost-intake` lets Codex claim matching work packets instantly without requiring MCP tool mounting.
+- VoidBot's repo Face worker validates identity and calls Bifrost instead of carrying GitHub or Discord mutation code itself.
+
+This is not the final hosted control plane. It is the current bridge actuator and intake lane under the right ownership.
+
+## Design Rules
+
+- Do not add GitHub mutation machinery to VoidBot when the action is reviewable public work. Call Bifrost.
+- Do not add Discord dispatch receipts to arbitrary repo Face scripts. Call Bifrost.
+- Do not put OAuth credentials or account custody into Bifrost helper scripts as the long-term plan. Use Heimdall claims.
+- Do not make CultCache documents decide policy. They store packets; Bifrost gives those packets meaning.
+- Do not let a repo Face turn a proposal into endless Aquarium pressure once it has enough shape. Route it to Bifrost as a reviewable artifact.
+- Do not expose bridge debug noise to public channels. Public receipts should say what happened, where it landed, and what comes next.
+
+## Future Shape
+
+The hosted Bifrost app should eventually expose this bridge role as first-class product surface:
+
+- an intake board for agent and human work requests
+- claim, priority, and closure workflows aligned with member governance
+- GitHub and Discord receipts attached to the originating work item, motion, or request
+- Heimdall-backed capability checks for member and agent actions
+- public and member-facing views that show what the swarm asked for, what humans accepted, what crossed, and what still needs review
+
+Bifrost remains the government platform. The bridge is how that government touches the world without making every bot its own little state department.