Refresh StreamPixels OAuth verification state

notes/fresh-workspace-handoff.md

@@ -78,6 +78,9 @@ Do not trust this file for the exact live HEAD. Always check git.
   Heimdall, redeems Heimdall completion codes server-side, writes its own
   viewer sessions and connector bindings, and resolves current provider access
   tokens from Heimdall without storing refresh tokens locally
+- Heimdall and StreamPixels are deployed on Yggdrasil for the StreamPixels
+  migration slice; Twitch callback handling has been patched so provider token
+  `scope` can be either a space-delimited string or an array
 - the ignored local `secrets/heimdall-service.env` artifact now has
   `GC_ACCESS_PROVIDER_TWITCH_*` and `GC_ACCESS_PROVIDER_YOUTUBE_*` populated
   for the StreamPixels migration slice
@@ -98,17 +101,15 @@ Do not trust this file for the exact live HEAD. Always check git.
 
 Do not continue implementation automatically from a rehydrate-only request.
 
-If the user asks to continue on StreamPixels, the current next move is deploy
-and real browser verification:
+If the user asks to continue on StreamPixels, the current next move is real
+browser verification:
 
-- deploy Heimdall with the staged Twitch/YouTube OAuth credentials and an app
-  shared secret for StreamPixels
-- configure StreamPixels service with `GC_ACCESS_BASE_URL`,
-  `GC_ACCESS_INTERNAL_URL`, and the same `GC_ACCESS_APP_SHARED_SECRET`
-- verify viewer claim/link through `/auth/connect`
+- verify viewer claim/link through `https://streampixels.gamecult.org/auth/connect`
 - verify creator connector attach from an admin creator session
 - confirm StreamPixels persists local profile/connector binding state while
   Heimdall retains provider token custody
+- if a provider callback fails, inspect Heimdall audit events and StreamPixels
+  service logs before touching app/domain boundaries
 
 Repixelizer still needs its real browser OAuth verification:
 

state/evidence.jsonl

@@ -17,3 +17,4 @@
 {"ts": "2026-04-29T13:37:17+00:00", "type": "provider", "status": "accepted", "note": "Patreon OAuth for Repixelizer is enabled through Heimdall with API v2 identity lookup. Repixelizer owns the access rule and sends patreon_membership_access with requiredTierTitle=Inner Sanctum; Heimdall evaluates the signed-in user's currently entitled Patreon tiers by title instead of currency amount."}
 {"ts": "2026-04-29T13:56:56+00:00", "type": "design", "status": "accepted", "note": "StreamPixels viewer and creator Twitch/YouTube OAuth now delegates to Heimdall. Heimdall owns provider OAuth, identity resolution, encrypted token custody, and app-authenticated access-token resolution; StreamPixels owns viewer profiles, creator memberships, connector bindings, diagnostics, EventSub/live-chat runtime behavior, and audience data."}
 {"ts": "2026-04-29T14:16:59+00:00", "type": "config", "status": "accepted", "note": "Local Heimdall deployment env artifact now contains StreamPixels Twitch and YouTube OAuth client credentials under secrets/heimdall-service.env as GC_ACCESS_PROVIDER_TWITCH_* and GC_ACCESS_PROVIDER_YOUTUBE_*; values remain ignored and unprinted. Google callback URI in the downloaded secret file was ignored in favor of the configured Heimdall callback."}
+{"ts": "2026-04-29T15:23:01+00:00", "type": "implementation", "status": "accepted", "note": "Twitch token exchange can return scope as an array; Heimdall now normalizes provider token scopes from string or array before storing managed credentials."}

state/map.yaml

@@ -98,5 +98,5 @@ rejected_paths:
     reason: reusing auth mechanics does not justify centralizing app-domain audience or product data
 
 current_status:
-  summary: Heimdall has a live Yggdrasil deployment for the Repixelizer auth path and now a local StreamPixels integration slice. The service has Ed25519 JWT signing/JWKS, signed OAuth state, Postgres-backed auth/control-plane persistence, encrypted managed provider token custody, real Discord and Patreon callback runtimes for Repixelizer, and generic Twitch/YouTube callback runtimes for StreamPixels identity and managed creator connections. StreamPixels now delegates Twitch/YouTube OAuth to Heimdall, redeems one-time completion codes through its service, writes its own httpOnly viewer session, stores local profile/creator connector binding state, and asks Heimdall for current provider access tokens when runtime code needs them. Twitch and YouTube OAuth client credentials have been staged into the ignored local Heimdall service env artifact. The key boundary still holds: Heimdall owns provider OAuth and credential custody; StreamPixels owns viewer profiles, creator memberships, connector config, diagnostics, EventSub/live-chat runtime behavior, and audience data.
-  next_action: Deploy/configure the StreamPixels-Heimdall slice using the staged Heimdall Twitch/YouTube provider credentials plus `GC_ACCESS_APP_SHARED_SECRET` on both Heimdall and StreamPixels, then run real browser flows for viewer claim/link and creator Twitch/YouTube connector attach. Confirm StreamPixels stores only local binding/runtime state for Heimdall-managed connector credentials and still gates creator/operator routes from local memberships.
+  summary: Heimdall and StreamPixels are deployed on Yggdrasil for the StreamPixels auth migration slice. Heimdall has Twitch/YouTube provider credentials, the shared StreamPixels app secret, generic Twitch/YouTube identity and managed-credential custody runtimes, and a live fix for Twitch token responses that return scopes as arrays. StreamPixels delegates Twitch/YouTube OAuth to Heimdall, redeems one-time completion codes through its service, writes its own httpOnly viewer session, stores local profile/creator connector binding state, and asks Heimdall for current provider access tokens when runtime code needs them. The key boundary still holds: Heimdall owns provider OAuth and credential custody; StreamPixels owns viewer profiles, creator memberships, connector config, diagnostics, EventSub/live-chat runtime behavior, and audience data.
+  next_action: Complete real browser verification for StreamPixels viewer sign-in/link and creator Twitch/YouTube connector attach from `https://streampixels.gamecult.org/auth/connect`. If Twitch or YouTube fails, inspect Heimdall audit events and StreamPixels service logs first; do not move provider-specific app state into Heimdall while debugging.