With no current list the proof goes only through a provider the member names, never the
session's sign-in provider: a sign-in through an unlinked provider makes Heimdall mint an
orphan account holding that login. Link buttons need a current list. The unlink completion
must say a step-up was requested. POST /auth/heimdall/complete answers no-store. The fake
Heimdall now models orphan minting, derives step_up_at from the start's stepUp flag, and
enforces the app secret, sign_in-only, unsupported-provider and 600 s rules.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Docs only. Mouth line numbers (shifted by about 100 lines of mouth code), bridge.md, packages.lock.json refs refreshed; Heimdall PR #6 is merged.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Docs only. Refreshes stale file and line references, drops the claim that OIDC must move to Status == Active (main already admits any non-Suspended account with a live training-notice receipt), names the new IsActiveMember callers, and updates the provider-list and Heimdall PR #6 notes.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
A missing secret silently switched Discord and Patreon member sign-in off.
Outside Development and Testing the validator now fails naming
Heimdall:AppSecretFile and Heimdall:AppSecret, never a value.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Soul pass on 25b9cc16: the warning level was unpinned (a Trace demotion passed) and the docs said one newline where the code trims all.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The mouth moved since bf8ff62: the pending answer is chat_pending.v2 with a
twelve-field delivery, a chat ack now posts a public m.read receipt and
releases stored images, and presence follows the brake. Update the line
references and the gaps, and record why a feedback ack must be its own kind.
No design change; the OIDC and account files are unchanged on main.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Design for the receiver half of Ratatoskr's Mind feedback pages: records, session
check, account-kind lookup, delivery as quoted data, erase redaction and gaps.
Design only; nothing implemented.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
A Persona's Mind shell holds no Matrix token, so the mouth now keeps one named image for her: it reads her live membership and the room's full state, takes content.url from the fetched event only, checks info.sha256 against the hash it computed, stores the bytes in her image store and posts the inert org.gamecult.file_received receipt as her own user. Behind CHAT_FETCH (exactly 1), off by default; an off mouth answers the kind as UnknownKind. Not deployed by this merge.
Shipper: Eureka. Reviewed by Heimdall against cut-mouth-fetch-attachment.r7 (bundle 3a6b45d, then delta d4bccd4: one log line per fetch with a fixed cause=, event-id percent-encoding pinned, doc-only change to docs/bridge.md).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
