From ba88a8581fa7961df8544b41479b027351c53e3f Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Thu, 20 Aug 2026 20:27:25 +0200 Subject: [PATCH] Record authenticated swarm health deployment --- notes/fresh-workspace-handoff.md | 25 ++++++++++++++----------- state/evidence.jsonl | 1 + state/map.yaml | 6 ++++-- 3 files changed, 19 insertions(+), 13 deletions(-) diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 5f9ff58..912d0ef 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -120,6 +120,16 @@ Do not trust this file for the exact live HEAD. Always check git. over `cultnet.transport.rudp.v0` when `GC_ACCESS_IDUNN_RUDP_HEALTH` is configured; HTTP `/healthz`, JWKS, discovery, systemd, and nginx routing remain compatibility witnesses +- Yggdrasil now runs Heimdall commit + `2a905354b9dc85101463030dea9045c1561a4638`. Heimdall persists its private + provider-health identity at `/srv/heimdall/keys/provider-health-identity.cc` + and publishes canonical signed health independently of the slower Verse + snapshot cadence. Idunn owns the exact root trust binding, authenticated + admission, lifecycle decision, and redacted public `.cc` projection. +- Odin commit `67f215fb57f688f5f8258ccc1dd7bd4288c631da` fixes Idunn's RUDP health and + public-query listeners so `EINTR` retries instead of killing the listener. + Live proof showed repeated authenticated Heimdall admissions and + `observe (daemon is healthy)` with both services active and zero restarts. ## Critical Doctrine @@ -135,17 +145,10 @@ Do not trust this file for the exact live HEAD. Always check git. Do not continue implementation automatically from a rehydrate-only request. -If the user asks to continue on the Idunn/swarm transport cut, the current next -move is deployment and live verification: - -- ship the `CultLib/packages/cultnet-ts` snapshot through the Yggdrasil - Heimdall deploy lane -- configure persistent `GC_ACCESS_CULTCACHE_PATH` under `/srv/heimdall` -- configure `GC_ACCESS_IDUNN_RUDP_HEALTH=10.77.0.2:17870` -- redeploy Heimdall on Yggdrasil -- update `check-heimdall.sh` to verify the witness store and the new `/healthz` - fields -- confirm live Idunn accepts `yggdrasil-heimdall` from `10.77.0.1` +The Idunn/swarm health transport cut is live. Do not regress Heimdall to +unsigned `idunn.daemon_health`, merge its private key into Idunn, or make HTTP +health an authority. The next product work is the Bifrost and remaining browser +verification listed below. If the user asks to continue on Spotiverse, the current next move is the real browser `/auth/login` flow through public Heimdall. The Yggdrasil SSH tunnel diff --git a/state/evidence.jsonl b/state/evidence.jsonl index ca86bd8..b8582f4 100644 --- a/state/evidence.jsonl +++ b/state/evidence.jsonl @@ -29,3 +29,4 @@ {"ts": "2026-06-08T20:02:27+00:00", "type": "implementation", "status": "accepted", "note": "Added Bifrost as a Heimdall app profile for Discord/Patreon member access. Bifrost owns KTLST role and Patreon tier policies through backend-callback OAuth starts; Heimdall owns provider OAuth/token custody and generic configured backend callback allowlisting."} {"ts": "2026-06-09T19:21:17+00:00", "type": "implementation", "status": "accepted", "note": "Bifrost patron support sync reuses Heimdall's existing linked Patreon identity and membership reader. Heimdall exposes app-authenticated /v1/apps/bifrost/patron-support/sync, refreshes Patreon custody when needed, maps active paid tier membership into a signed RecurringSupportSnapshot, and posts it to Bifrost's /heimdall/patron-support/events intake; Bifrost owns points, tiers, voting weight, and ledger meaning."} {"ts": "2026-06-16T16:59:54+00:00", "type": "implementation", "status": "accepted", "note": "Heimdall now writes a daemon-owned CultCache boundary store with provider advertisement, command boundary, transport profile, and daemon-health summary state, and can publish heimdall.cultnet-rudp-provider-health to Idunn over cultnet.transport.rudp.v0 when configured."} +{"ts":"2026-08-20T18:25:37+00:00","type":"deployment","status":"ok","note":"Yggdrasil runs Heimdall commit 2a905354b9dc85101463030dea9045c1561a4638 with a persistent machine-bound Ed25519 provider-health identity and canonical idunn.signed_daemon_health.v1 publication. Idunn at Odin commit 67f215fb57f688f5f8258ccc1dd7bd4288c631da has the exact root trust binding, survived interrupted UDP receives, repeatedly admitted Heimdall as authority=authenticated, evaluated it healthy, and wrote the redacted public provider-health .cc projection. Both services were active with zero restarts and the deployment brake engaged."} diff --git a/state/map.yaml b/state/map.yaml index 4bbeb3f..bbe5ad5 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -33,6 +33,7 @@ invariants: - StreamPixels can reuse shared auth authority without centralizing streamer-audience data. - Spotiverse consumes Spotify as a Heimdall-managed credential; Spotiverse does not own Spotify refresh-token custody. - Heimdall's first Odin/Eve daemon boundary publication remains secret-safe: it writes only provider advertisement, command boundary, transport profile, and daemon-health summary state, not per-account auth truth. + - Heimdall owns its persistent provider-health signing identity and signed observations; Idunn owns root-bound admission and the public provider-health projection. Unsigned health is never lifecycle authority. - Persistent state cruft is the same failure class as architecture cruft. data_flow: @@ -102,6 +103,7 @@ landed_baseline: - Heimdall exposes `POST /v1/apps/bifrost/patron-support/sync` as an app-authenticated bridge from linked Patreon membership evidence to Bifrost's signed patron support intake endpoint. - A read-only `gamecult.eve.provider_advertisement.v1` export now advertises Heimdall provider/app surfaces plus redacted CultCache witness document paths for Odin/Eve discovery. - Heimdall now writes a daemon-owned `GC_ACCESS_CULTCACHE_PATH` boundary store containing provider advertisement, command boundary, transport profile, and daemon-health summary state, and it can publish `heimdall.cultnet-rudp-provider-health` to Idunn over `cultnet.transport.rudp.v0` when configured. + - Heimdall now persists a machine-bound Ed25519 provider-health identity, publishes canonical `idunn.signed_daemon_health.v1` records on an independent sequential pulse loop, and is admitted by Idunn through an exact root trust binding. rejected_paths: - name: per_app_auth_copy_paste @@ -112,5 +114,5 @@ rejected_paths: reason: reusing auth mechanics does not justify centralizing app-domain audience or product data current_status: - summary: Heimdall and StreamPixels are deployed on Yggdrasil for the StreamPixels auth migration slice. Heimdall has Twitch/YouTube provider credentials, the shared StreamPixels app secret, generic Twitch/YouTube identity and managed-credential custody runtimes, and a live fix for Twitch token responses that return scopes as arrays. Live StreamPixels Twitch sign-in through Heimdall has succeeded and redeemed a completion code. StreamPixels delegates Twitch/YouTube OAuth to Heimdall, redeems one-time completion codes server-side, writes its own httpOnly viewer session, stores local profile/creator binding state, and asks Heimdall for current provider access tokens when runtime code needs them. Spotiverse is added as a Heimdall app profile with Spotify as a managed credential provider. Bifrost is added as a Heimdall app profile for Discord/Patreon member access through backend-callback handoff, with Bifrost owning KTLST role and Patreon tier policies while Heimdall owns provider OAuth/token custody and callback allowlist enforcement. Bifrost patron support sync now reuses Heimdall's linked Patreon identity and membership reader to emit signed recurring-support facts to Bifrost; Bifrost still owns ledgers, patron points, voting weight, and audit meaning. Heimdall now also has a daemon-owned boundary witness store and optional Idunn RUDP health pulse for the swarm transport cut. The key boundary still holds: Heimdall owns provider OAuth and credential custody; host apps own local sessions, route/resource checks, runtime behavior, and app-domain data. - next_action: Ship the CultLib snapshot through the Yggdrasil Heimdall deploy lane, deploy with a persistent `GC_ACCESS_CULTCACHE_PATH` plus `GC_ACCESS_IDUNN_RUDP_HEALTH=10.77.0.2:17870`, then update `check-heimdall.sh` to verify the witness store and confirm live Idunn accepts `yggdrasil-heimdall` from `10.77.0.1`. After that, return to Bifrost patron-support sync and the remaining browser verification passes. + summary: Heimdall is deployed on Yggdrasil at commit `2a905354b9dc85101463030dea9045c1561a4638`. Its daemon-owned boundary witness remains secret-safe, and its lifecycle health now crosses CultNet/RUDP as canonical signed state from a persistent machine-bound identity. Idunn has the exact root trust binding, admits the records as authenticated, evaluates Heimdall healthy, and publishes the redacted provider projection. Odin commit `67f215fb57f688f5f8258ccc1dd7bd4288c631da` keeps Idunn's health-ingress and public-query UDP listeners alive across interrupted system calls. The deployment brake is engaged; Heimdall and Idunn are active with zero restarts. + next_action: Return to Bifrost patron-support sync and the remaining browser verification passes. Preserve the signed health owner split: Heimdall signs observations; Idunn admits and projects them.