From ccc713b911a6a736c9bfb8433ec7c0d2ade1902e Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Wed, 29 Apr 2026 11:54:01 +0100 Subject: [PATCH] Clarify Repixelizer Discord role policy --- docs/implementation-plan.md | 6 +++--- docs/service-contract.md | 4 ++-- notes/fresh-workspace-handoff.md | 8 ++++---- state/evidence.jsonl | 1 + state/map.yaml | 2 +- 5 files changed, 11 insertions(+), 10 deletions(-) diff --git a/docs/implementation-plan.md b/docs/implementation-plan.md index 892e962..eb354d2 100644 --- a/docs/implementation-plan.md +++ b/docs/implementation-plan.md @@ -79,7 +79,7 @@ Goals: - configure the Discord OAuth app redirect URI to `https://heimdall.gamecult.org/v1/oauth/discord/callback` - configure Heimdall's Discord client credentials, Repixelizer guild id, and - allowed role ids + the Cultist role id in `GC_ACCESS_APP_REPIXELIZER_DISCORD_ALLOWED_ROLE_IDS` - configure Repixelizer for `GC_ACCESS_MODE=heimdall` and `GC_ACCESS_ALLOWED_PROVIDERS=discord` - run the live browser OAuth flow and confirm Repixelizer receives the backend @@ -90,8 +90,8 @@ Current Discord policy: - Heimdall grants Repixelizer `entitlement.app_access` only when the Discord member has one of the configured allowed role ids -- if launch policy should be "any member of the GameCult Discord," change the - Discord entitlement rule before deploying +- launch policy is intentionally role-gated: the GameCult Discord can remain + public, but Repixelizer access is limited to members with the Cultist role ### 4. Migrate StreamPixels without flattening its good local seams diff --git a/docs/service-contract.md b/docs/service-contract.md index 5ecf533..0c55a60 100644 --- a/docs/service-contract.md +++ b/docs/service-contract.md @@ -476,5 +476,5 @@ Deploy and verify the hardened slice in the first real app binding: - confirm direct backend callback delivery to Repixelizer - confirm Repixelizer verifies the Heimdall access token locally and gates hosted routes from the adopted session -- decide whether Repixelizer launch policy is role-gated Discord access or any - guild member access before deployment +- configure Repixelizer access as role-gated Discord access: the GameCult guild + may be public, but the allowed role list should contain the Cultist role id diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index d574f3a..bd174d7 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -91,16 +91,16 @@ Repixelizer launch path: - configure the Discord OAuth app redirect URI as `https://heimdall.gamecult.org/v1/oauth/discord/callback` - configure Heimdall with Discord client id/secret, Repixelizer guild id, - allowed role ids, Postgres storage, token encryption, and stable signing keys + the Cultist role id in `GC_ACCESS_APP_REPIXELIZER_DISCORD_ALLOWED_ROLE_IDS`, + Postgres storage, token encryption, and stable signing keys - configure Repixelizer to use `GC_ACCESS_MODE=heimdall` and `GC_ACCESS_ALLOWED_PROVIDERS=discord` - run the real browser OAuth flow end to end and confirm Repixelizer receives the backend callback, verifies the token, adopts a local session, and gates hosted routes -Important wrinkle: Heimdall currently grants Repixelizer access from Discord -role matches, not bare guild membership. If launch policy is "any GameCult -Discord member can enter," update the Discord entitlement rule before deploy. +Launch policy is role-gated on purpose: the GameCult Discord can remain public, +but Repixelizer access is limited to members with the Cultist role. ## Immediate Re-entry Instruction diff --git a/state/evidence.jsonl b/state/evidence.jsonl index 5bdc1b5..0a5c8fb 100644 --- a/state/evidence.jsonl +++ b/state/evidence.jsonl @@ -10,3 +10,4 @@ {"ts": "2026-04-26T15:22:58+00:00", "type": "implementation", "status": "accepted", "note": "Heimdall now supports file-backed signing-key loading/bootstrap, AES-256-GCM token sealing for managed provider credentials at rest, and a local JWT verifier seam in src/verifier.ts; the next move shifts from custody hardening to the first real Repixelizer consumer integration."} {"ts": "2026-04-26T16:00:35+00:00", "type": "design", "status": "accepted", "note": "Heimdall now supports direct backend callback delivery as the preferred same-host or Yggdrasil-reachable app handoff path; the browser completion-code redeem flow remains as fallback, not the primary consumer contract."} {"ts": "2026-04-29T10:51:08+00:00", "type": "design", "status": "accepted", "note": "Repixelizer has consumed Heimdall's direct backend callback flow locally, so Heimdall is no longer blocked on Repixelizer auth refactoring. The next Heimdall objective is Discord-only live launch configuration and end-to-end OAuth verification on Yggdrasil; other providers remain catalogued but callback runtimes are not implemented yet."} +{"ts": "2026-04-29T10:53:44+00:00", "type": "design", "status": "accepted", "note": "Repixelizer Discord launch policy is intentionally role-gated: the GameCult guild can remain public, but Heimdall should grant Repixelizer app access only to members with the Cultist role configured in GC_ACCESS_APP_REPIXELIZER_DISCORD_ALLOWED_ROLE_IDS."} diff --git a/state/map.yaml b/state/map.yaml index c39eee3..6882791 100644 --- a/state/map.yaml +++ b/state/map.yaml @@ -94,4 +94,4 @@ rejected_paths: current_status: summary: Heimdall has a hardened first provider slice plus a direct app-backend handoff path: TypeScript/Fastify runtime, Ed25519 JWT signing with file-backed key support, JWKS/discovery exposure, signed OAuth start-state handling, durable auth/control-plane persistence, a real Discord callback path, AES-256-GCM token sealing for managed provider credentials at rest, a local JWT verifier seam for app backends, direct backend callback delivery for same-host consumers, and the older one-time completion-code exchange retained as fallback. Repixelizer has now consumed that flow locally in its hosted web layer, so Heimdall is no longer blocked on Repixelizer refactoring. The live launch path should start Discord-only; Patreon, GitHub, Twitch, and YouTube are catalogued providers but their callback runtimes are still not implemented. The key boundary still holds: Heimdall owns auth/control-plane authority and credential custody; app-domain bindings and runtime behavior remain app-owned. - next_action: Prepare and verify the live Discord-only Repixelizer launch on Yggdrasil: configure the Discord OAuth app redirect to `https://heimdall.gamecult.org/v1/oauth/discord/callback`, set Heimdall env for Discord client credentials, Repixelizer guild/allowed role ids, Postgres storage, token encryption, and stable signing keys, set Repixelizer to `GC_ACCESS_ALLOWED_PROVIDERS=discord`, then run the real browser OAuth flow end to end. If access should allow any guild member rather than specific role ids, change Heimdall's Discord entitlement rule before deployment. + next_action: Prepare and verify the live Discord-only Repixelizer launch on Yggdrasil: configure the Discord OAuth app redirect to `https://heimdall.gamecult.org/v1/oauth/discord/callback`, set Heimdall env for Discord client credentials, Repixelizer guild id, the Cultist role id in `GC_ACCESS_APP_REPIXELIZER_DISCORD_ALLOWED_ROLE_IDS`, Postgres storage, token encryption, and stable signing keys, set Repixelizer to `GC_ACCESS_ALLOWED_PROVIDERS=discord`, then run the real browser OAuth flow end to end. The GameCult guild can remain public; Repixelizer access is intentionally limited to members with the Cultist role.