GameCult/Heimdall
Watch
9
0
Fork
You've already forked Heimdall
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Record authenticated swarm health deployment

Browse source
This commit is contained in:
Meta Vens 2026-08-20 20:27:25 +02:00
commit ba88a8581f
3 changed files with 19 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

25
notes/fresh-workspace-handoff.md
View file

@ -120,6 +120,16 @@ Do not trust this file for the exact live HEAD. Always check git.
over `cultnet.transport.rudp.v0` when `GC_ACCESS_IDUNN_RUDP_HEALTH` is
configured; HTTP `/healthz`, JWKS, discovery, systemd, and nginx routing
remain compatibility witnesses
- Yggdrasil now runs Heimdall commit
`2a905354b9dc85101463030dea9045c1561a4638`. Heimdall persists its private
provider-health identity at `/srv/heimdall/keys/provider-health-identity.cc`
and publishes canonical signed health independently of the slower Verse
snapshot cadence. Idunn owns the exact root trust binding, authenticated
admission, lifecycle decision, and redacted public `.cc` projection.
- Odin commit `67f215fb57f688f5f8258ccc1dd7bd4288c631da` fixes Idunn's RUDP health and
public-query listeners so `EINTR` retries instead of killing the listener.
Live proof showed repeated authenticated Heimdall admissions and
`observe (daemon is healthy)` with both services active and zero restarts.
## Critical Doctrine
@ -135,17 +145,10 @@ Do not trust this file for the exact live HEAD. Always check git.
Do not continue implementation automatically from a rehydrate-only request.
If the user asks to continue on the Idunn/swarm transport cut, the current next
move is deployment and live verification:
- ship the `CultLib/packages/cultnet-ts` snapshot through the Yggdrasil
Heimdall deploy lane
- configure persistent `GC_ACCESS_CULTCACHE_PATH` under `/srv/heimdall`
- configure `GC_ACCESS_IDUNN_RUDP_HEALTH=10.77.0.2:17870`
- redeploy Heimdall on Yggdrasil
- update `check-heimdall.sh` to verify the witness store and the new `/healthz`
fields
- confirm live Idunn accepts `yggdrasil-heimdall` from `10.77.0.1`
The Idunn/swarm health transport cut is live. Do not regress Heimdall to
unsigned `idunn.daemon_health`, merge its private key into Idunn, or make HTTP
health an authority. The next product work is the Bifrost and remaining browser
verification listed below.
If the user asks to continue on Spotiverse, the current next move is the real
browser `/auth/login` flow through public Heimdall. The Yggdrasil SSH tunnel

1
state/evidence.jsonl
View file

@ -29,3 +29,4 @@
{"ts": "2026-06-08T20:02:27+00:00", "type": "implementation", "status": "accepted", "note": "Added Bifrost as a Heimdall app profile for Discord/Patreon member access. Bifrost owns KTLST role and Patreon tier policies through backend-callback OAuth starts; Heimdall owns provider OAuth/token custody and generic configured backend callback allowlisting."}
{"ts": "2026-06-09T19:21:17+00:00", "type": "implementation", "status": "accepted", "note": "Bifrost patron support sync reuses Heimdall's existing linked Patreon identity and membership reader. Heimdall exposes app-authenticated /v1/apps/bifrost/patron-support/sync, refreshes Patreon custody when needed, maps active paid tier membership into a signed RecurringSupportSnapshot, and posts it to Bifrost's /heimdall/patron-support/events intake; Bifrost owns points, tiers, voting weight, and ledger meaning."}
{"ts": "2026-06-16T16:59:54+00:00", "type": "implementation", "status": "accepted", "note": "Heimdall now writes a daemon-owned CultCache boundary store with provider advertisement, command boundary, transport profile, and daemon-health summary state, and can publish heimdall.cultnet-rudp-provider-health to Idunn over cultnet.transport.rudp.v0 when configured."}
{"ts":"2026-08-20T18:25:37+00:00","type":"deployment","status":"ok","note":"Yggdrasil runs Heimdall commit 2a905354b9dc85101463030dea9045c1561a4638 with a persistent machine-bound Ed25519 provider-health identity and canonical idunn.signed_daemon_health.v1 publication. Idunn at Odin commit 67f215fb57f688f5f8258ccc1dd7bd4288c631da has the exact root trust binding, survived interrupted UDP receives, repeatedly admitted Heimdall as authority=authenticated, evaluated it healthy, and wrote the redacted public provider-health .cc projection. Both services were active with zero restarts and the deployment brake engaged."}

6
state/map.yaml
View file

@ -33,6 +33,7 @@ invariants:
- StreamPixels can reuse shared auth authority without centralizing streamer-audience data.
- Spotiverse consumes Spotify as a Heimdall-managed credential; Spotiverse does not own Spotify refresh-token custody.
- Heimdall's first Odin/Eve daemon boundary publication remains secret-safe: it writes only provider advertisement, command boundary, transport profile, and daemon-health summary state, not per-account auth truth.
- Heimdall owns its persistent provider-health signing identity and signed observations; Idunn owns root-bound admission and the public provider-health projection. Unsigned health is never lifecycle authority.
- Persistent state cruft is the same failure class as architecture cruft.
data_flow:
@ -102,6 +103,7 @@ landed_baseline:
- Heimdall exposes `POST /v1/apps/bifrost/patron-support/sync` as an app-authenticated bridge from linked Patreon membership evidence to Bifrost's signed patron support intake endpoint.
- A read-only `gamecult.eve.provider_advertisement.v1` export now advertises Heimdall provider/app surfaces plus redacted CultCache witness document paths for Odin/Eve discovery.
- Heimdall now writes a daemon-owned `GC_ACCESS_CULTCACHE_PATH` boundary store containing provider advertisement, command boundary, transport profile, and daemon-health summary state, and it can publish `heimdall.cultnet-rudp-provider-health` to Idunn over `cultnet.transport.rudp.v0` when configured.
- Heimdall now persists a machine-bound Ed25519 provider-health identity, publishes canonical `idunn.signed_daemon_health.v1` records on an independent sequential pulse loop, and is admitted by Idunn through an exact root trust binding.
rejected_paths:
- name: per_app_auth_copy_paste
@ -112,5 +114,5 @@ rejected_paths:
reason: reusing auth mechanics does not justify centralizing app-domain audience or product data
current_status:
summary: Heimdall and StreamPixels are deployed on Yggdrasil for the StreamPixels auth migration slice. Heimdall has Twitch/YouTube provider credentials, the shared StreamPixels app secret, generic Twitch/YouTube identity and managed-credential custody runtimes, and a live fix for Twitch token responses that return scopes as arrays. Live StreamPixels Twitch sign-in through Heimdall has succeeded and redeemed a completion code. StreamPixels delegates Twitch/YouTube OAuth to Heimdall, redeems one-time completion codes server-side, writes its own httpOnly viewer session, stores local profile/creator binding state, and asks Heimdall for current provider access tokens when runtime code needs them. Spotiverse is added as a Heimdall app profile with Spotify as a managed credential provider. Bifrost is added as a Heimdall app profile for Discord/Patreon member access through backend-callback handoff, with Bifrost owning KTLST role and Patreon tier policies while Heimdall owns provider OAuth/token custody and callback allowlist enforcement. Bifrost patron support sync now reuses Heimdall's linked Patreon identity and membership reader to emit signed recurring-support facts to Bifrost; Bifrost still owns ledgers, patron points, voting weight, and audit meaning. Heimdall now also has a daemon-owned boundary witness store and optional Idunn RUDP health pulse for the swarm transport cut. The key boundary still holds: Heimdall owns provider OAuth and credential custody; host apps own local sessions, route/resource checks, runtime behavior, and app-domain data.
next_action: Ship the CultLib snapshot through the Yggdrasil Heimdall deploy lane, deploy with a persistent `GC_ACCESS_CULTCACHE_PATH` plus `GC_ACCESS_IDUNN_RUDP_HEALTH=10.77.0.2:17870`, then update `check-heimdall.sh` to verify the witness store and confirm live Idunn accepts `yggdrasil-heimdall` from `10.77.0.1`. After that, return to Bifrost patron-support sync and the remaining browser verification passes.
summary: Heimdall is deployed on Yggdrasil at commit `2a905354b9dc85101463030dea9045c1561a4638`. Its daemon-owned boundary witness remains secret-safe, and its lifecycle health now crosses CultNet/RUDP as canonical signed state from a persistent machine-bound identity. Idunn has the exact root trust binding, admits the records as authenticated, evaluates Heimdall healthy, and publishes the redacted provider projection. Odin commit `67f215fb57f688f5f8258ccc1dd7bd4288c631da` keeps Idunn's health-ingress and public-query UDP listeners alive across interrupted system calls. The deployment brake is engaged; Heimdall and Idunn are active with zero restarts.
next_action: Return to Bifrost patron-support sync and the remaining browser verification passes. Preserve the signed health owner split: Heimdall signs observations; Idunn admits and projects them.