Heimdall
87a1bb6b3b
Start refusal: bound the body read, survive undecodable bodies, pin the code length cap
...
Soul pass on c085cead
2026-11-12 14:41:14 +00:00
Heimdall
c085cead9d
Heimdall start refusal: log the HTTP status and Heimdall's error code
...
The journal said only 'Heimdall rejected the auth start', which cannot tell a wrong app secret (401 app_auth_required) from a fault. The message now carries the status and, when the body has one, an error code that is a short snake_case token; no other body text is echoed.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-11-12 14:26:14 +00:00
fe0ff40864
Merge pull request 'Heimdall__AppSecretFile: keep the Heimdall app secret out of the process environment' ( #78 ) from heimdall/appsecret-file into main
2026-11-12 13:46:25 +00:00
Heimdall
280d843aeb
AppSecretFile: pin the deprecation at Warning level, say trailing newlines
...
Soul pass on 25b9cc16
2026-11-12 13:46:24 +00:00
Heimdall
25b9cc1683
Document Heimdall__AppSecretFile and the AppSecret deprecation
...
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-11-12 13:24:59 +00:00
Heimdall
95d2e8d262
Read the Heimdall app secret from Heimdall__AppSecretFile; env value deprecated
...
The file wins, is read once when the options are built, and a set-but-missing,
unreadable or empty file stops startup in every environment without naming the
secret. Heimdall__AppSecret still works and logs a deprecation warning.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-11-12 13:24:59 +00:00
b80b27da0f
Linux path fixes: containment by path.relative, hostile-cursor test, verify prerequisites ( #77 )
2026-11-12 12:55:35 +00:00
420a4dbf85
Mouth: follow upgrades only a plain basis; @room keeps room ( #76 )
2026-11-12 12:28:39 +00:00
a1b173079d
tests: dispatch-gate tests run on Linux; classify the remaining Yggdrasil failures ( #75 )
2026-11-12 12:24:51 +00:00
afafff18bd
Mouth: basis "follow" for engagement peers (CHAT_FOLLOW, default off) ( #74 )
2026-11-12 12:21:31 +00:00
c2de290628
Desk: UnixSocketDeskDoor (Huginn desk door client), fixtures at 79d954c, card re-pin to CultLib 3a51bbab, card opaque ( #70 )
2026-11-12 11:44:45 +00:00
b1725a106f
docs: sealed-motion Mind key path is /var/lib/mind-<persona>; register only after a Persona-shell self-test ( #32 )
2026-11-12 10:31:05 +00:00
d26aa50041
Docs: desk feed visibility is Huginn's door policy; cite the written door spec ( #69 )
2026-11-12 10:17:33 +00:00
4cb83971f9
Desk: bearer credential (OpenIddict validation, desk.read/desk.answer, audience bifrost-desk) and answerer masking ( #71 )
2026-11-12 10:17:29 +00:00
d4365a8364
Mouth: fetch one named event's image for its Persona, store it, post an inert receipt (CHAT_FETCH, off by default) ( #73 )
...
A Persona's Mind shell holds no Matrix token, so the mouth now keeps one named image for her: it reads her live membership and the room's full state, takes content.url from the fetched event only, checks info.sha256 against the hash it computed, stores the bytes in her image store and posts the inert org.gamecult.file_received receipt as her own user. Behind CHAT_FETCH (exactly 1), off by default; an off mouth answers the kind as UnknownKind. Not deployed by this merge.
Shipper: Eureka. Reviewed by Heimdall against cut-mouth-fetch-attachment.r7 (bundle 3a6b45dd4bccd4
2026-11-12 00:59:28 +00:00
0d820fdc00
Mouth: id shape on every delivery field, mentions bounded in bytes, round cap counts every target GET ( #72 )
2026-11-11 21:06:13 +00:00
7231cdb977
Mouth: reply_to lows after #64 (round cap defers, 60 s excerpt, wider scrub, id shape) ( #68 )
2026-11-11 20:05:46 +00:00
f6a826b6e7
Desk feed design: per-Mind open forks, read-only (decisions in PR #37 section 14) ( #67 )
2026-11-11 17:06:45 +00:00
6acb4980b8
docs: how a Ratatoskr voting module authenticates to Bifrost (design) ( #37 )
2026-11-11 17:06:31 +00:00
e8e8fcc178
Docs: no refresh token, MAS skips userinfo; withdrawal stops new tokens, open sessions run to expiry ( #66 )
2026-11-11 16:48:27 +00:00
1da912d5e9
Members: approve refuses no-membership/unknown accounts; neutral text for legacy suspensions ( #65 )
2026-11-11 16:39:48 +00:00
e12b8e2298
Mouth: v4 fixes after Soul pass (target cache, scrub, read cap) ( #64 )
2026-11-11 16:17:09 +00:00
dc35c4a254
Mouth: chat_pending.v4 reply_to (flag, default off) ( #63 )
2026-11-11 16:06:28 +00:00
ab89556101
Chat sign-in needs a live consent receipt; notice frozen as version 1 ( #59 )
2026-11-11 14:32:06 +00:00
e8df60630e
Prefix lengths: host-level startup tests (tests only) ( #62 )
2026-11-11 14:12:55 +00:00
7813426e6d
Drop HTMX (unpkg, no integrity); guard against third-party assets ( #61 )
2026-11-11 14:12:51 +00:00
70a2038435
Suspension gaps: bootstrap, demotion, members-page notices, admin-only reason ( #60 )
2026-11-11 14:12:47 +00:00
1571bf3e32
Consent: optional at registration, a consent page, CSRF-guarded accept/withdraw, notice v2 ( #58 )
2026-11-11 12:11:02 +00:00
028bc2fdf6
Registration: sign-up form with proof-of-work and a no-JS time-lock fallback ( #56 )
2026-11-11 11:17:25 +00:00
b2e0bb2514
Mouth: tail_gaps on chat_pending.v3, the rooms whose tail is incomplete ( #57 )
2026-11-11 11:07:35 +00:00
09addd83d8
Docs: proposed training notice v2 and consent-flow gaps ( #55 )
2026-11-11 10:32:18 +00:00
33be966b7d
Registration gates: proof-of-work CAPTCHA and training-notice consent receipt ( #54 )
2026-11-11 10:15:46 +00:00
fc8242f655
Suspension survives sign-in; admin-only Suspend/Unsuspend with a receipt ( #53 )
2026-11-11 08:38:09 +00:00
e8722d0abf
Mouth: room tail on chat_pending.v3 ( #51 )
2026-11-11 08:15:38 +00:00
24f3deb88e
OIDC issuer: chat tier for accounts without Active membership ( #52 )
2026-11-11 08:13:09 +00:00
5201508bdc
OIDC issuer: address budget, token-row cap, scheduled prune, marker brake ( #50 )
2026-11-11 08:12:48 +00:00
be44a09d52
OIDC: refuse reserved localparts at authorize; gap list in oidc-issuer.md ( #49 )
2026-11-11 06:39:35 +00:00
1d0548313c
Mouth: addressing facts on deliveries (chat_pending.v3 basis and form) ( #48 )
2026-11-11 06:26:30 +00:00
4e86c33cd2
Resolve CultLib via VOIDBOT_CULTLIB_ROOT in tests; test formerly indexed stores ( #47 )
2026-11-11 05:01:33 +00:00
68dee25e3a
Drop indexes: declarations from TS document types ( #46 )
2026-11-11 04:53:55 +00:00
781e6eabf6
Desk: pin vectors to CultLib de8a062a ( #45 )
2026-11-11 02:16:28 +00:00
05dcceb203
Desk: a stale answer on an oversize fork is 422 fork_too_large ( #44 )
2026-11-11 01:54:04 +00:00
815304568f
Desk: pin vectors to CultLib f6c9bf5f ( #43 )
2026-11-11 01:49:37 +00:00
8385eca00f
Desk: a read of an oversize fork is 422 fork_too_large ( #42 )
2026-11-11 01:35:07 +00:00
7e9ba5796b
Desk: the fork desk's Bifrost half ( #40 )
2026-11-11 01:02:36 +00:00
12a153f66f
Mill votes: ranked, paged read and not-yet-voted-by-this-network filter ( #41 )
2026-11-10 21:06:56 +00:00
73c6f50440
persona mouth: open a direct room for a Persona; answer unknown kinds loudly ( #39 )
2026-11-10 18:35:51 +00:00
752cd66686
deploy plan: restore reads a postgres-readable copy of the root-only dump ( #38 )
2026-11-10 18:28:31 +00:00
1a3fa02373
Merge pull request 'Reserve Matrix localparts and system names at identity creation' ( #34 ) from heimdall/reserved-identities into main
2026-11-10 17:32:16 +00:00
55a97f2250
Merge pull request 'Matrix mouth: m.read follows a chat_read report, presence follows the turn' ( #35 ) from heimdall/mouth-read-through into main
2026-11-10 17:32:03 +00:00
