From 185a30fbd8a67cf182dc3625ec5301587aafa314 Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Wed, 29 Apr 2026 16:25:35 +0100 Subject: [PATCH] Record StreamPixels Twitch verification --- notes/fresh-workspace-handoff.md | 5 +++++ state/evidence.jsonl | 1 + state/map.yaml | 4 ++-- 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 770567b..01bef52 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -81,6 +81,9 @@ Do not trust this file for the exact live HEAD. Always check git. - Heimdall and StreamPixels are deployed on Yggdrasil for the StreamPixels migration slice; Twitch callback handling has been patched so provider token `scope` can be either a space-delimited string or an array +- live StreamPixels Twitch sign-in through Heimdall has succeeded on Yggdrasil + and Heimdall audit showed callback success, completion creation, and + completion redemption - the ignored local `secrets/heimdall-service.env` artifact now has `GC_ACCESS_PROVIDER_TWITCH_*` and `GC_ACCESS_PROVIDER_YOUTUBE_*` populated for the StreamPixels migration slice @@ -105,6 +108,8 @@ If the user asks to continue on StreamPixels, the current next move is real browser verification: - verify viewer claim/link through `https://streampixels.gamecult.org/auth/connect` +- Twitch viewer sign-in has already passed once; continue with YouTube and + connector attachment verification - verify creator connector attach from an admin creator session - confirm StreamPixels persists local profile/connector binding state while Heimdall retains provider token custody diff --git a/state/evidence.jsonl b/state/evidence.jsonl index 8e60cb9..e92ae0b 100644 --- a/state/evidence.jsonl +++ b/state/evidence.jsonl @@ -18,3 +18,4 @@ {"ts": "2026-04-29T13:56:56+00:00", "type": "design", "status": "accepted", "note": "StreamPixels viewer and creator Twitch/YouTube OAuth now delegates to Heimdall. Heimdall owns provider OAuth, identity resolution, encrypted token custody, and app-authenticated access-token resolution; StreamPixels owns viewer profiles, creator memberships, connector bindings, diagnostics, EventSub/live-chat runtime behavior, and audience data."} {"ts": "2026-04-29T14:16:59+00:00", "type": "config", "status": "accepted", "note": "Local Heimdall deployment env artifact now contains StreamPixels Twitch and YouTube OAuth client credentials under secrets/heimdall-service.env as GC_ACCESS_PROVIDER_TWITCH_* and GC_ACCESS_PROVIDER_YOUTUBE_*; values remain ignored and unprinted. Google callback URI in the downloaded secret file was ignored in favor of the configured Heimdall callback."} {"ts": "2026-04-29T15:23:01+00:00", "type": "implementation", "status": "accepted", "note": "Twitch token exchange can return scope as an array; Heimdall now normalizes provider token scopes from string or array before storing managed credentials."} +{"ts": "2026-04-29T15:25:08+00:00", "type": "verification", "status": "accepted", "note": "Live StreamPixels Twitch sign-in through Heimdall succeeded on Yggdrasil: Heimdall audit shows oauth_callback_succeeded, auth_completion_created, and auth_completion_redeemed for twitch after the scope normalization deploy."} diff --git a/state/map.yaml b/state/map.yaml index f124ed4..13eb990 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -98,5 +98,5 @@ rejected_paths: reason: reusing auth mechanics does not justify centralizing app-domain audience or product data current_status: - summary: Heimdall and StreamPixels are deployed on Yggdrasil for the StreamPixels auth migration slice. Heimdall has Twitch/YouTube provider credentials, the shared StreamPixels app secret, generic Twitch/YouTube identity and managed-credential custody runtimes, and a live fix for Twitch token responses that return scopes as arrays. StreamPixels delegates Twitch/YouTube OAuth to Heimdall, redeems one-time completion codes through its service, writes its own httpOnly viewer session, stores local profile/creator connector binding state, and asks Heimdall for current provider access tokens when runtime code needs them. The key boundary still holds: Heimdall owns provider OAuth and credential custody; StreamPixels owns viewer profiles, creator memberships, connector config, diagnostics, EventSub/live-chat runtime behavior, and audience data. - next_action: Complete real browser verification for StreamPixels viewer sign-in/link and creator Twitch/YouTube connector attach from `https://streampixels.gamecult.org/auth/connect`. If Twitch or YouTube fails, inspect Heimdall audit events and StreamPixels service logs first; do not move provider-specific app state into Heimdall while debugging. + summary: Heimdall and StreamPixels are deployed on Yggdrasil for the StreamPixels auth migration slice. Heimdall has Twitch/YouTube provider credentials, the shared StreamPixels app secret, generic Twitch/YouTube identity and managed-credential custody runtimes, and a live fix for Twitch token responses that return scopes as arrays. Live StreamPixels Twitch sign-in through Heimdall has succeeded and redeemed a completion code. StreamPixels delegates Twitch/YouTube OAuth to Heimdall, redeems one-time completion codes through its service, writes its own httpOnly viewer session, stores local profile/creator connector binding state, and asks Heimdall for current provider access tokens when runtime code needs them. The key boundary still holds: Heimdall owns provider OAuth and credential custody; StreamPixels owns viewer profiles, creator memberships, connector config, diagnostics, EventSub/live-chat runtime behavior, and audience data. + next_action: Complete the remaining real browser verification for StreamPixels: YouTube sign-in/link, creator Twitch/YouTube connector attach from an admin creator session, and local StreamPixels persistence checks. If a provider callback fails, inspect Heimdall audit events and StreamPixels service logs first; do not move provider-specific app state into Heimdall while debugging.