Allow Inner Sanctum Repixelizer access

docs/implementation-plan.md

@@ -85,7 +85,8 @@ Goals:
 - configure the Discord OAuth app redirect URI to
   `https://heimdall.gamecult.org/v1/oauth/discord/callback`
 - configure Heimdall's Discord client credentials, Repixelizer guild id, and
-  the Cultist role id in `GC_ACCESS_APP_REPIXELIZER_DISCORD_ALLOWED_ROLE_IDS`
+  the Repixelizer Discord access role ids in
+  `GC_ACCESS_APP_REPIXELIZER_DISCORD_ALLOWED_ROLE_IDS`
 - configure Repixelizer for `GC_ACCESS_MODE=heimdall` and
   `GC_ACCESS_ALLOWED_PROVIDERS=discord`
 - run the live browser OAuth flow and confirm Repixelizer receives the backend
@@ -106,7 +107,8 @@ Current Discord policy:
 - Heimdall grants Repixelizer `entitlement.app_access` only when the Discord
   member has one of the configured allowed role ids
 - launch policy is intentionally role-gated: the GameCult Discord can remain
-  public, but Repixelizer access is limited to members with the Cultist role
+  public, but Repixelizer access is limited to members with either `KLTST`
+  or the Patreon-synced `Inner Sanctum` role
 
 ### 4. Migrate StreamPixels without flattening its good local seams
 

docs/service-contract.md

@@ -477,4 +477,5 @@ Deploy and verify the hardened slice in the first real app binding:
 - confirm Repixelizer verifies the Heimdall access token locally and gates
   hosted routes from the adopted session
 - configure Repixelizer access as role-gated Discord access: the GameCult guild
-  may be public, but the allowed role list should contain the Cultist role id
+  may be public, but the allowed role list should contain the `KLTST` and
+  Patreon-synced `Inner Sanctum` role ids

notes/fresh-workspace-handoff.md

@@ -96,7 +96,8 @@ If the user asks to continue, the current next move is real browser OAuth
 verification:
 
 - open `https://repixelizer.gamecult.org/app/`
-- start Discord sign-in with an account that has the `KLTST` role
+- start Discord sign-in with an account that has the `KLTST` or
+  Patreon-synced `Inner Sanctum` role
 - confirm Heimdall receives the Discord callback and evaluates guild role
   entitlement
 - confirm Repixelizer receives the backend callback, verifies the Heimdall
@@ -105,7 +106,8 @@ verification:
   guilds.members.read`
 
 Launch policy is role-gated on purpose: the GameCult Discord can remain public,
-but Repixelizer access is limited to members with the Cultist role.
+but Repixelizer access is limited to members with either `KLTST` or the
+Patreon-synced `Inner Sanctum` role.
 
 ## Immediate Re-entry Instruction
 

state/evidence.jsonl

@@ -12,3 +12,4 @@
 {"ts": "2026-04-29T10:51:08+00:00", "type": "design", "status": "accepted", "note": "Repixelizer has consumed Heimdall's direct backend callback flow locally, so Heimdall is no longer blocked on Repixelizer auth refactoring. The next Heimdall objective is Discord-only live launch configuration and end-to-end OAuth verification on Yggdrasil; other providers remain catalogued but callback runtimes are not implemented yet."}
 {"ts": "2026-04-29T10:53:44+00:00", "type": "design", "status": "accepted", "note": "Repixelizer Discord launch policy is intentionally role-gated: the GameCult guild can remain public, but Heimdall should grant Repixelizer app access only to members with the Cultist role configured in GC_ACCESS_APP_REPIXELIZER_DISCORD_ALLOWED_ROLE_IDS."}
 {"ts": "2026-04-29T11:39:36+00:00", "type": "deployment", "status": "accepted", "note": "Heimdall is deployed on Yggdrasil behind nginx at https://heimdall.gamecult.org with Postgres storage, file-backed Ed25519 signing key bootstrap, configured token custody, and public JWKS/discovery/health checks passing. Repixelizer is deployed at https://repixelizer.gamecult.org in Heimdall mode with Discord as the only provider, required access enabled, and queue protection enabled; public auth-start returns a Discord authorization URL using the Heimdall callback and Repixelizer backend handoff."}
+{"ts": "2026-04-29T12:06:26+00:00", "type": "config", "status": "accepted", "note": "Repixelizer Discord access now accepts either KLTST (861962027550244914) or the Patreon-synced Inner Sanctum role (1497585425491955894) via GC_ACCESS_APP_REPIXELIZER_DISCORD_ALLOWED_ROLE_IDS."}

state/map.yaml

@@ -96,4 +96,4 @@ rejected_paths:
 
 current_status:
   summary: Heimdall has a live first Yggdrasil deployment for the Discord-only Repixelizer path: TypeScript/Fastify runtime behind nginx/TLS at `https://heimdall.gamecult.org`, Ed25519 JWT signing with bootstrapped file-backed key support, JWKS/discovery exposure, signed OAuth start-state handling, Postgres-backed auth/control-plane persistence, a real Discord callback path, AES-256-GCM token sealing for managed provider credentials at rest, direct backend callback delivery for Repixelizer, and the older one-time completion-code exchange retained as fallback. Repixelizer is deployed at `https://repixelizer.gamecult.org` in Heimdall mode with Discord as the only public provider, required access enabled, and queue protection enabled. Public health/discovery/JWKS/config checks pass, and public auth-start returns a Discord authorization URL using the Heimdall callback plus Repixelizer backend handoff. Patreon, GitHub, Twitch, and YouTube are catalogued providers but their callback runtimes are still not implemented. The key boundary still holds: Heimdall owns auth/control-plane authority and credential custody; app-domain bindings and runtime behavior remain app-owned.
-  next_action: Run the real browser OAuth flow end to end from `https://repixelizer.gamecult.org/app/` with a Discord account that has the `KLTST` role, confirm Heimdall receives the Discord callback, confirms guild role entitlement, delivers the backend callback to Repixelizer, Repixelizer adopts a local httpOnly session, and hosted/queue routes are gated correctly. The public OAuth start URL should request only `identify guilds.members.read`.
+  next_action: Run the real browser OAuth flow end to end from `https://repixelizer.gamecult.org/app/` with a Discord account that has the `KLTST` role or the Patreon-synced `Inner Sanctum` role, confirm Heimdall receives the Discord callback, confirms guild role entitlement, delivers the backend callback to Repixelizer, Repixelizer adopts a local httpOnly session, and hosted/queue routes are gated correctly. The public OAuth start URL should request only `identify guilds.members.read`.