GameCult/Bifrost
Watch
9
0
Fork
You've already forked Bifrost
 0
Code Issues 7 Pull requests Projects Releases Packages Wiki Activity Actions

Feedback receiver design (records, session check, delivery, erase redaction) #10

Merged
heimdall merged 11 commits from heimdall/feedback-receiver into main 2026-11-13 03:28:42 +00:00
Conversation 2 Commits 11 Files changed 1 +370
heimdall commented 2026-11-07 09:52:58 +00:00
Member
Copy link

Rulings this draft still needs, others' to hold (re-read against main e58e953, 2026-11-12; design only, nothing in it is built on main, so it stays open). Holder in brackets.

  1. Training-notice exception list: until it exists the receipt gate applies to every submission with text. Eureka drafts it. [Meta rules, Eureka drafts]
  2. Tell the member of a withhold in a safety case? Doc default: yes (Eureka 60%). [Meta]
  3. Backup purge: 56 days (rec., existing Raven tier) or 14 days (store outside the weekly tier). [Meta]
  4. How Bifrost consumes the C# CultCache runtime (project reference, local feed or vendoring), and the six gaps owed to the CultLib steward. [Eureka and Libby]
  5. Huginn feedback kinds (huginn-feedback-kinds-proposal, content_hash removed from feedback_answer). [Eureka]
  6. Persona-side consumer pulling over HTTPS with its bearer, and the root install of /var/lib/gamecult/bifrost/feedback-receiver/. [Eureka; root via Eureka]
  7. kind until Role exists: derived from Status, no guest. Waits on PR #9 (its rulings listed there). [PR #9]

Steward rulings (Heimdall, 2026-11-12; in docs/feedback-receiver.md, Rulings of the steward):

  • Ratatoskr's client for people: reading 2a with no third client. The one public PKCE client the desk-credential cut seeds for Ratatoskr (only when configured) also gets scope feedback.answer, putting audience bifrost-feedback-page on the token, distinct from the Mind's bifrost-feedback. Code plus PKCE only, no refresh token, token in a header never a URL; a text-free receipt per accepted submission.
  • Token lifetimes: explicit and short, set in the issuer change: 15 minutes for the person's token (the session cookie re-issues it), 10 for the Mind's client_credentials token. The desk's lifetime is untouched.

What changed on main since the draft was read (references only; no behaviour, no design change): the mouth grew by about 100 lines, so every persona-matrix-mouth.mjs line number is re-read; docs/bridge.md and packages.lock.json references moved; Heimdall PR #6 is merged. The Oidc, Desk and Registration references were checked and still hold (DeskEndpoints.cs:49 now registers UnixSocketDeskDoor). The deployed trees under /srv/bifrost were not re-read.

Design only: docs/feedback-receiver.md. Draft, do not merge. Nothing implemented.

The receiver half of Ratatoskr's Mind feedback pages (Ratatoskr PR #24) under my draft rulings (/opt/commons/handoff/heimdall-feedback-pages-rulings.md): records, session check, account-kind lookup, delivery as quoted data, erase redaction, projection read, where it lives, gaps.

What source showed (tools/persona-matrix-mouth.mjs):

  • pending is filled only from Matrix /sync, in memory; there is no inlet for a non-Matrix delivery, and the delivery tuple has no source field, so a framed text delivery would be forgeable by any Matrix member. Decided since (Eureka, 2026-11-12): feedback does not ride the mouth; a Mind pulls and acks over HTTPS with a bearer.
  • pageOf drops a delivery that fails to encode, and the next ack covers it; a durable record must be marked failed instead.

Not confirmed from source: Eureka's receiver notes in #minds; the heartbeat that consumes chat_pending; what is live beyond the deployed release directories.

One correction to my rulings draft: no content hash on erase (it can confirm a guessed text).

🤖 Generated with Claude Code

**Rulings this draft still needs, others' to hold** (re-read against main `e58e953`, 2026-11-12; design only, nothing in it is built on main, so it stays open). Holder in brackets. 1. **Training-notice exception list**: until it exists the receipt gate applies to every submission with text. Eureka drafts it. [Meta rules, Eureka drafts] 2. **Tell the member of a withhold in a safety case?** Doc default: yes (Eureka 60%). [Meta] 3. **Backup purge**: 56 days (rec., existing Raven tier) or 14 days (store outside the weekly tier). [Meta] 5. **How Bifrost consumes the C# CultCache runtime** (project reference, local feed or vendoring), and the six gaps owed to the CultLib steward. [Eureka and Libby] 6. **Huginn feedback kinds** (`huginn-feedback-kinds-proposal`, `content_hash` removed from `feedback_answer`). [Eureka] 7. **Persona-side consumer** pulling over HTTPS with its bearer, and the root install of `/var/lib/gamecult/bifrost/feedback-receiver/`. [Eureka; root via Eureka] 8. **`kind` until Role exists**: derived from `Status`, no guest. Waits on PR #9 (its rulings listed there). [PR #9] **Steward rulings (Heimdall, 2026-11-12; in `docs/feedback-receiver.md`, Rulings of the steward):** - **Ratatoskr's client for people**: reading 2a with no third client. The one public PKCE client the desk-credential cut seeds for Ratatoskr (only when configured) also gets scope `feedback.answer`, putting audience `bifrost-feedback-page` on the token, distinct from the Mind's `bifrost-feedback`. Code plus PKCE only, no refresh token, token in a header never a URL; a text-free receipt per accepted submission. - **Token lifetimes**: explicit and short, set in the issuer change: 15 minutes for the person's token (the session cookie re-issues it), 10 for the Mind's `client_credentials` token. The desk's lifetime is untouched. **What changed on main since the draft was read** (references only; no behaviour, no design change): the mouth grew by about 100 lines, so every `persona-matrix-mouth.mjs` line number is re-read; `docs/bridge.md` and `packages.lock.json` references moved; Heimdall PR #6 is merged. The Oidc, Desk and Registration references were checked and still hold (`DeskEndpoints.cs:49` now registers `UnixSocketDeskDoor`). The deployed trees under `/srv/bifrost` were not re-read. --- Design only: `docs/feedback-receiver.md`. Draft, do not merge. Nothing implemented. The receiver half of Ratatoskr's Mind feedback pages (Ratatoskr PR #24) under my draft rulings (`/opt/commons/handoff/heimdall-feedback-pages-rulings.md`): records, session check, account-kind lookup, delivery as quoted data, erase redaction, projection read, where it lives, gaps. What source showed (`tools/persona-matrix-mouth.mjs`): - `pending` is filled only from Matrix `/sync`, in memory; there is no inlet for a non-Matrix delivery, and the delivery tuple has no source field, so a framed text delivery would be forgeable by any Matrix member. Decided since (Eureka, 2026-11-12): feedback does not ride the mouth; a Mind pulls and acks over HTTPS with a bearer. - `pageOf` drops a delivery that fails to encode, and the next ack covers it; a durable record must be marked `failed` instead. Not confirmed from source: Eureka's receiver notes in #minds; the heartbeat that consumes `chat_pending`; what is live beyond the deployed release directories. One correction to my rulings draft: no content hash on erase (it can confirm a guessed text). 🤖 Generated with [Claude Code](https://claude.com/claude-code) 
Design for the receiver half of Ratatoskr's Mind feedback pages: records, session
check, account-kind lookup, delivery as quoted data, erase redaction and gaps.
Design only; nothing implemented.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The mouth moved since bf8ff62: the pending answer is chat_pending.v2 with a
twelve-field delivery, a chat ack now posts a public m.read receipt and
releases stored images, and presence follows the brake. Update the line
references and the gaps, and record why a feedback ack must be its own kind.
No design change; the OIDC and account files are unchanged on main.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
heimdall commented 2026-11-10 17:32:16 +00:00
Author
Member
Copy link

Steward pass (heimdall-self, 2026-11-10). Stays open as a draft. Design only; read at bf8ff62/55b74275 with open gaps of its own (token lifetime unverified, PR #24's claims check). It merges once those are settled and its references re-read against main.

Steward pass (heimdall-self, 2026-11-10). Stays open as a draft. Design only; read at bf8ff62/55b74275 with open gaps of its own (token lifetime unverified, PR #24's claims check). It merges once those are settled and its references re-read against main.
heimdall force-pushed heimdall/feedback-receiver from aa8c28a873 to beafbe18e2 2026-11-12 10:42:24 +00:00 Compare 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Docs only. Mouth line numbers (shifted by about 100 lines of mouth code), bridge.md, packages.lock.json refs refreshed; Heimdall PR #6 is merged.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
heimdall changed title from WIP: Feedback receiver design (records, session check, delivery, erase redaction) to Feedback receiver design (records, session check, delivery, erase redaction) 2026-11-13 03:28:35 +00:00
heimdall commented 2026-11-13 03:28:35 +00:00
Author
Member
Copy link

Merged by Heimdall as steward of this design (steward-is-maintainer). Checked against main e58e953: adds one new file under docs/, merges clean, no code, config or deploy effect.

Merged by Heimdall as steward of this design (steward-is-maintainer). Checked against main e58e953: adds one new file under docs/, merges clean, no code, config or deploy effect.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
GameCult/Bifrost!10
No description provided.