GameCult/Bifrost
Watch
9
0
Fork
You've already forked Bifrost
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 1

Commit graph

  • 6548ca8385 mouth: deliver media events as a typed line heimdall/mouth-media-line Heimdall 2026-11-03 18:09:43 +00:00
  • e396305c19 Merge pull request 'The mouth refuses a Persona send when the room moved past what she held' (#1) from eureka-body/optimistic-send-mouth into main main Heimdall 2026-11-03 11:03:11 +00:00
  • 7adc7315a3 send gate: re-check the brake after the gate wait, before the PUT eureka-body/optimistic-send-mouth Eureka 2026-11-03 10:37:22 +00:00
  • 2387cbc7f6 send gate tests: pin the head read's shape Meta Vens 2026-11-03 11:06:39 +01:00
  • 981164173f send gate tests: arrival order is the gate's, not the call site's Meta Vens 2026-11-03 11:02:47 +01:00
  • 2dd4bd863e persona matrix mouth: send gate tests, the captured #swarm head, v2 golden fixtures Meta Vens 2026-11-03 11:02:07 +01:00
  • a76c70cc39 persona matrix mouth: a v2 send is refused if the room moved past her basis; check and PUT are one step per room across every Persona Meta Vens 2026-11-03 11:01:44 +01:00
  • c29c5d1a4e persona matrix mouth: a delivery's context is read from Matrix, not remembered eureka-body/mouth-context-from-matrix Meta Vens 2026-10-31 05:10:57 +01:00
  • 98689b787d persona matrix mouth: each Persona's rooms are the shared MATRIX_ROOMS plus her own MATRIX_ROOMS_<SLUG> eureka-body/mouth-per-persona-rooms Meta Vens 2026-10-31 04:12:31 +01:00
  • 3bff0d779c persona matrix mouth: log the many-peer server's errors and keep serving eureka-body/mouth-many-peers Meta Vens 2026-10-31 01:51:47 +01:00
  • b892c64f00 persona matrix mouth: one session per client on the many-peer RUDP server; every request answered on the connection it arrived on Meta Vens 2026-10-31 01:33:36 +01:00
  • a7621f9eed Research: Discord-like roles on Matrix and the chat client (matrix-roles-from-bifrost-estates) Meta Vens 2026-10-30 18:09:44 +01:00
  • ccb0e6b08c Research: email mouth prior art (payment-mints-invite-bifrost-ledger-email-mouth) Meta Vens 2026-10-30 18:02:30 +01:00
  • 6cf24644bc Research: customer-member onboarding prior art and body facts (customers-get-voting-power-onboarding-owed) Meta Vens 2026-10-30 19:09:05 +01:00
  • cc76f0f2d0 mouth-all-personas: one Matrix mouth serves every Persona; deliveries carry mentions and is_direct, refusals are typed; same-server DM invites accepted; the ring is deleted (Persona turns are the heartbeat's) (squash of eureka-body/mouth-all-personas 7b63031..5b628e2; Soul s1-s3) Meta Vens 2026-10-30 02:49:59 +01:00
  • 18bbe6c312 Research: estate tally adds bloc-parliament-at-threshold and operator influence cap (Fork Desk 41) Meta Vens 2026-10-29 22:15:38 +01:00
  • 1036849534 Research: estate tally note points at its sims/ folder Meta Vens 2026-10-29 22:07:49 +01:00
  • 3f241c0fe4 Research: estate tally game theory, power indices and simulations (Fork Desk 39, estate-internal-tally) Meta Vens 2026-10-29 22:07:10 +01:00
  • eee86193c0 Research: swarm governance on Bifrost, readiness and prior art (follow-up swarm-governance-on-bifrost) Meta Vens 2026-10-29 21:48:14 +01:00
  • 7b630312e1 persona-mouth: Matrix ear and mouth for Personas (brake-refusing sends, token only in the Authorization header, cursor after ack, one ring per idle window); delete the Discord posting actuator (squash of eureka-body/persona-mouth 1894f65..ab2bdc6; Soul s1) Meta Vens 2026-10-29 19:41:30 +01:00
  • 1894f653d0 Back-channel logout: members who leave Active are logged out of chat (gamecult-chat cut bifrost-oidc-backchannel-logout r2) Meta Vens 2026-10-28 02:10:34 +01:00
  • 37c8fe1a72 Logout tests: pin the loop's own tick-failure catch now that subject faults are isolated gamecult-chat/bifrost-oidc-backchannel-logout Meta Vens 2026-10-28 01:57:31 +01:00
  • 8340ee0e92 Logout reconciler: one subject's unexpected exception does not stop the pass Meta Vens 2026-10-28 01:50:54 +01:00
  • ec66fba5ca Logout client: no auto-redirect, pin the redirect rule and the 10 s timeout Meta Vens 2026-10-28 01:50:53 +01:00
  • 51fe807b66 Logout loop test: the tick failure is logged by exception type only Meta Vens 2026-10-28 01:03:02 +01:00
  • 868b91fefb Logout reconciler: a recovered subject's backoff clears at once, not when it expires Meta Vens 2026-10-28 00:57:31 +01:00
  • af64868326 Logout tests: loop, log content, 2xx range, backoff reset, exception and cancellation paths Meta Vens 2026-10-28 00:56:18 +01:00
  • c9e470bef4 docs/oidc-issuer: BackchannelLogoutUri, reconcile semantics, MAS facts and the tick-window tradeoff Meta Vens 2026-10-28 00:39:57 +01:00
  • 69b670e3af Fix logout test support compile errors Meta Vens 2026-10-28 00:38:56 +01:00
  • 404dafdd40 OIDC back-channel logout: a reconciler ends the sessions of subjects who are not Active Meta Vens 2026-10-28 00:38:15 +01:00
  • 83daabe512 Bifrost as OIDC issuer for the Matrix chat (gamecult-chat cut bifrost-oidc-issuer, squash of 1ef289a..ec4acfa and abd12b3..) Meta Vens 2026-10-27 04:57:16 +01:00
  • ec4acfaa83 Userinfo re-checks Active membership through the token endpoint's one check; tests cover every non-Active state and the real deletion cascade gamecult-chat/bifrost-oidc-issuer Meta Vens 2026-10-27 04:42:27 +01:00
  • 1ef289ab45 Take OpenIddict's context seam in the in-memory application store Meta Vens 2026-10-27 04:13:59 +01:00
  • 4566b15d65 Name the key type, not the context, in the in-memory application store's base type Meta Vens 2026-10-27 04:13:08 +01:00
  • 0750d7a59e Run the stale-client test on a store that skips OpenIddict's bulk delete, which the in-memory database cannot execute Meta Vens 2026-10-27 04:12:10 +01:00
  • dfb25da22d Give the stale-client test's old client the profile scope permission so its control request can issue a code Meta Vens 2026-10-27 04:08:27 +01:00
  • 443b0fd4fb Oidc behaviour fixes: remove stale clients at seeding, re-check Active at the token endpoint, pin issuer and parked lifetime by tests, one PKCE owner, drop the unread consent type Meta Vens 2026-10-27 04:06:37 +01:00
  • 0f377de406 Regenerate both lockfiles for the OpenIddict server and EF packages Meta Vens 2026-10-27 03:54:02 +01:00
  • 30417e3702 Merge origin/main (dependency pins) into the OIDC issuer branch Meta Vens 2026-10-27 03:53:12 +01:00
  • 78d38d92e6 Merge security/bifrost-dependency-pins: Npgsql 8.0.3, System.Text.Json 8.0.5, Caching.Memory 8.0.1 pinned; NuGet lockfiles; locked-mode restore (audit 2026-10-22; Soul cleared) Meta Vens 2026-10-22 23:45:01 +02:00
  • d7d4b21c4b Commit NuGet lockfiles for the web and test projects security/bifrost-dependency-pins Meta Vens 2026-10-22 23:29:46 +02:00
  • a15648db04 Pin Npgsql 8.0.3, System.Text.Json 8.0.5, Caching.Memory 8.0.1; enable NuGet lockfiles Meta Vens 2026-10-22 23:26:49 +02:00
  • abd12b30d2 Revert "OIDC endpoints: typed lambdas instead of Delegate-cast method groups" Meta Vens 2026-10-22 20:09:30 +02:00
  • a6b9bd00e6 OIDC tests: the re-seeding test runs on its own host so its drifted client cannot reach the other tests Meta Vens 2026-10-22 20:05:32 +02:00
  • 849c9e71fa OIDC endpoints: typed lambdas instead of Delegate-cast method groups Meta Vens 2026-10-22 20:02:07 +02:00
  • 1cb1639170 OIDC tests: the client re-seeding test reads the stored row, since the manager cache holds the drifted instance Meta Vens 2026-10-22 19:59:44 +02:00
  • 06ca8209da OIDC: tests for key-material faults, scope-limited claims, userinfo refusal, client re-seeding; redirect URI must be http(s) Meta Vens 2026-10-22 18:40:11 +02:00
  • 5339122167 OIDC tests pin the JWKS path; docs say what the encryption key protects Meta Vens 2026-10-22 18:36:13 +02:00
  • e0640bdaa0 Docs: Bifrost issues GameCult identity, Heimdall authenticates; oidc-issuer.md Meta Vens 2026-10-22 18:35:34 +02:00
  • b4dcd1de89 OIDC issuer: provider endpoints, authorize gate (Active members, identity required), one MAS client, tests Meta Vens 2026-10-22 18:35:34 +02:00
  • caef679bb5 OIDC issuer: OpenIddict 7.7.1, Bifrost:Oidc options, key material, EF migration for OpenIddict tables Meta Vens 2026-10-22 18:35:33 +02:00
  • b2110f53fa Merge hands/heimdall-callback-signed Meta Vens 2026-10-22 18:11:28 +02:00
  • b7e3bdf28d Heimdall sign-in: the attempt reader takes no optional nonce; ownership is one ordinal comparison hands/heimdall-callback-signed Meta Vens 2026-10-11 23:02:48 +02:00
  • d743e4f363 Heimdall tests: an unreadable form with a genuine attempt cookie present is still no attempt Meta Vens 2026-10-11 23:00:06 +02:00
  • efb278a910 Heimdall tests: the no-attempt-field refusal carries a genuine code, so only the missing nonce can refuse it Meta Vens 2026-10-11 22:57:26 +02:00
  • d463336206 Heimdall tests: a genuine attempt cookie under a name that is no slot is no attempt Meta Vens 2026-10-11 22:41:31 +02:00
  • b54e8d5dc8 Heimdall tests: fix a string literal in the parallel-starts test Meta Vens 2026-10-11 22:32:07 +02:00
  • 053272a0f3 Heimdall tests: re-point the cookie-ring tests to the slot cookie; a refusal with no matching attempt deletes nothing Meta Vens 2026-10-11 22:31:25 +02:00
  • 15f96c408c Heimdall sign-in: attempt cookies live in a ring of two fixed slots, so the Cookie header is bounded by construction; pin the completion form's id Meta Vens 2026-10-11 22:25:24 +02:00
  • 8186d6f8fa Heimdall tests: drop the exact-byte boundary test; the 5120-byte bound has a 3 KB margin, and no two attempt cookies can reach it Meta Vens 2026-10-11 21:33:17 +02:00
  • 21f2c75c78 Heimdall tests: name the sums near the bound when the boundary pair is missing Meta Vens 2026-10-11 21:32:31 +02:00
  • ec2f812b59 Heimdall attempt cookie bound: pin the exact byte boundary and that unrelated cookies are never swept Meta Vens 2026-10-11 21:26:31 +02:00
  • 4a28cea1f9 Heimdall sign-in: Start sweeps dead and oldest attempt cookies to keep the Cookie header bounded; pin the complete page's real form Meta Vens 2026-10-11 20:41:41 +02:00
  • 79c29fe16e Merge hands/mill-votes-cut-5b: vote budgets per prefix and account, mint budget 30 per address per hour, monotonic windows, oldest-unexhausted eviction at the cap Meta Vens 2026-10-11 20:35:34 +02:00
  • cf74019194 Mill votes: the very-busy refusal offers sign-in to a voter who is not signed in hands/mill-votes-cut-5b Meta Vens 2026-10-11 20:23:59 +02:00
  • a9b9b29bf9 Pin the account table's own cap Meta Vens 2026-10-11 19:58:09 +02:00
  • 912d083894 Fix a string literal broken across lines in the table-full test Meta Vens 2026-10-11 19:17:27 +02:00
  • 436a02864f Vote budgets: at the cap a new key evicts the least recently used key with permits left Meta Vens 2026-10-11 19:16:30 +02:00
  • 8f57dc89f0 Pin the no-client-address bucket of the vote budgets Meta Vens 2026-10-11 17:38:56 +02:00
  • a8c3ecf495 Vote budgets: monotonic windows, a key cap, 30 mints an hour and a readable 429 Meta Vens 2026-10-11 17:32:01 +02:00
  • 2c8384e44a Pin that a signed-in retract spends the account budget Meta Vens 2026-10-11 09:46:45 +02:00
  • 9fcef927fd Pin the budget sweep and Retry-After rounding; drop a redundant Math.Max Meta Vens 2026-10-11 09:35:50 +02:00
  • 34f5dfa6f1 Heimdall attempt cookie: a deletion carries only the Path Meta Vens 2026-10-11 09:08:10 +02:00
  • 7f375ecf8f Pin the empty Origin branch with a server-built request Meta Vens 2026-10-11 09:02:01 +02:00
  • 0f71a9f3ca Heimdall tests: fix two log-join string literals broken by a newline Meta Vens 2026-10-11 09:01:06 +02:00
  • fbf6e43955 Concept vote rate limits: cast and mint budgets per account or network prefix Meta Vens 2026-10-11 09:00:23 +02:00
  • cf4e5b4327 Heimdall complete page: run its real script under Node in tests Meta Vens 2026-10-11 08:58:20 +02:00
  • d695674359 Heimdall sign-in: redact the app secret from client logging, expire the attempt cookie at its path, bound the return path Meta Vens 2026-10-11 08:58:19 +02:00
  • f5432f7a42 Heimdall sign-in: pin the public base URL path, the nonce shape and the Discord role requirement; drop a redundant key re-check Meta Vens 2026-10-11 05:25:14 +02:00
  • ad06e2ffd5 Heimdall completion route: no antiforgery opt-out (the form is read by hand); pin a malformed form body Meta Vens 2026-10-11 04:43:45 +02:00
  • 713eff934a Heimdall tests: register the GitHub OAuth scheme through host settings so the sign-in return path can be read from its state Meta Vens 2026-10-11 04:42:50 +02:00
  • 5626532571 Heimdall sign-in: the start result carries the cookie name; fix a test string literal Meta Vens 2026-10-11 04:41:36 +02:00
  • bad2117ea8 Heimdall sign-in: the attempt is a cookie, and a code the browser presents is redeemed at Heimdall Meta Vens 2026-10-11 04:40:47 +02:00
  • 1ab67da47b Heimdall sign-in tests: pin each refusal rule by its reason; token dates cannot overflow Meta Vens 2026-10-11 03:26:48 +02:00
  • 650bf6bcc6 Heimdall token verifier: split decoding and key reading into small steps Meta Vens 2026-10-11 03:05:07 +02:00
  • e99eea8769 Heimdall token verifier: one process-wide instance owns the key cache Meta Vens 2026-10-11 02:55:35 +02:00
  • f3b8acbbc5 Heimdall sign-in: accept only a Heimdall-signed token for an attempt Start issued, in the browser that started it Meta Vens 2026-10-11 02:54:13 +02:00
  • 68214ced30 Merge hands/mill-votes-cut-5: the vote page, the device-cookie voter key and cookieless CSRF Meta Vens 2026-10-11 00:54:41 +02:00
  • 526102ec8a ConceptVotePageTests: pin a repeated Origin header and the exact client-error codes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> hands/mill-votes-cut-5 Meta Vens 2026-10-11 00:26:21 +02:00
  • 75d2cedaa2 ConceptVotePageTests: drop the empty-Origin case (HttpClient never sends an empty header) Meta Vens 2026-10-11 00:18:06 +02:00
  • d3a7611f2a Vote page: explicit no-store (the antiforgery write no longer supplies it), handler must match the request, empty Origin counts as present Meta Vens 2026-10-11 00:15:13 +02:00
  • 30ba2af3c1 ConceptVotePageTests: close the Visitor class correctly Meta Vens 2026-10-11 00:13:42 +02:00
  • 6554a1b017 ConceptVotePageTests: fix a stray brace Meta Vens 2026-10-11 00:11:50 +02:00
  • 59d5dbd068 Vote page: gate in the page filter's execution stage (the selected stage has no Result) Meta Vens 2026-10-11 00:11:01 +02:00
  • e0b3b1a38a Vote page: cookieless CSRF (Origin / Sec-Fetch-Site) and a defined error for handler-less requests Meta Vens 2026-10-11 00:09:25 +02:00
  • 0c6f9216b6 Merge origin/main into hands/mill-votes-cut-5 Meta Vens 2026-10-11 00:06:51 +02:00
  • 72741198fa Merge hands/mill-votes-cut-3: concept subject registration from the Mill manifest Meta Vens 2026-10-10 23:42:02 +02:00
  • c9e0b7b0e1 Registry tests: pin the order of already-retired entries hands/mill-votes-cut-3 Meta Vens 2026-10-10 23:26:43 +02:00
  • 747183078a Registry tests: build the over-bound manifest as an array Meta Vens 2026-10-10 23:08:11 +02:00
  • 9c4124dd9f Registry tests: spell the separator and format characters as escapes Meta Vens 2026-10-10 23:04:00 +02:00