Record Odin-discovered access deployment

README.md

@@ -51,12 +51,17 @@ Landed right now:
   `heimdall.auth.begin` and `heimdall.auth.complete`; app payloads and completion
   claims are AES-256-GCM wrapped and HMAC-bound to expiry, nonce, operation,
   runtime, and idempotency identity
+- redacted provider, command-boundary, plugin, and transport records published
+  through Odin under unique typed catalog keys; secret-bearing auth state never
+  enters the catalog
+- the deployed Ghostlight Eve host consumes that discovered boundary and keeps
+  routine app-session verification local
 
-Still not landed:
+Remaining work:
 
-- the Ghostlight Eve-host consumer migration and deployed two-account canary
+- the two-account and eight-account Ghostlight human canaries
 - refresh/revocation flows and admin surfaces
-- full redacted per-document Heimdall auth witness export or CultMesh publication
+- broader admin and inspection projections beyond the redacted access boundary
 
 Canonical docs:
 

docs/architecture.md

@@ -2,8 +2,8 @@
 
 ## What this file is
 
-This file is the shared architecture note for Heimdall, the planned auth
-authority service for GameCult-hosted experiments.
+This file is the shared architecture note for Heimdall, GameCult's auth
+authority service for hosted experiments.
 
 Its basic promise is:
 
@@ -13,7 +13,8 @@ Its basic promise is:
 - issue signed local claims that hosted apps can verify without trusting raw
   provider tokens
 
-It is not a map of landed auth code yet.
+Implementation and live-release detail belongs in the handoff and evidence
+ledger; this file owns the authority model.
 
 ## Problem
 
@@ -95,6 +96,14 @@ navigation receipts whose origin appears in both the plugin advertisement and
 the validated receipt. It never receives access or refresh claims. The host app
 redeems the handle, verifies the Heimdall claim, and owns its local session.
 
+Heimdall publishes four redacted discovery documents to Odin: provider
+advertisement, command boundary, plugin advertisement, and transport profile.
+Their record keys are globally unique within Odin's catalog. Odin persists and
+returns these documents but does not proxy private auth commands. Consumers
+resolve the route through Odin, validate the advertised loopback/HMAC/AES
+contract, and talk directly to Heimdall. Claims, completions, provider tokens,
+app secrets, and account state never enter Odin or public CultMesh.
+
 ## Provider taxonomy
 
 Heimdall should classify outside systems by what role they play, not by whether

docs/implementation-plan.md

@@ -89,10 +89,19 @@ Landed in Heimdall:
 
 Remaining outside this repo:
 
-- Ghostlight must consume the plugin, verify returned claims, and own its local
-  sessions
-- Idunn must deploy the new release and Odin must witness the plugin and route
-  metadata
+- complete the two-account and eight-account Ghostlight human canaries
+- pressure refresh, logout, stale completion, and Odin-outage behavior through
+  the deployed browser host
+
+Live proof:
+
+- Heimdall `1086aee01169bf60e8a492b2740db1c6f3e8cabf` with CultLib
+  `5cefa0db0079a8e3ee22f29d7b9e6e5aa60912a9` is active on Yggdrasil
+- Odin's typed snapshot returns the provider, command boundary, plugin, and
+  transport profile under their unique record keys
+- Ghostlight accepted a canonical anonymous `heimdall.auth.begin` by resolving
+  that boundary through Odin; the navigation receipt exposed only advertised
+  Discord and Heimdall origins
 
 ### 1. Lock the service boundary
 

notes/fresh-workspace-handoff.md

@@ -27,6 +27,18 @@ Do not trust this file for the exact live HEAD. Always check git.
 
 ## Current Orientation
 
+- Yggdrasil runs Heimdall
+  `1086aee01169bf60e8a492b2740db1c6f3e8cabf` with CultLib
+  `5cefa0db0079a8e3ee22f29d7b9e6e5aa60912a9`
+- Heimdall publishes four redacted access records to Odin under unique keys:
+  `eve:provider:heimdall`, `heimdall:command-boundary`,
+  `eve:plugin:gamecult.heimdall.access`, and `heimdall:transport-profile`
+- Odin `b4f9a2e95f0b41cebdeddc49223781d1d3c7b42a` persists and returns all four;
+  it does not proxy private commands or receive claims
+- Ghostlight `b515ca90c25573005a616244143803b37f2d06ec` resolves the boundary through
+  Odin and accepted a live canonical anonymous `heimdall.auth.begin`; its unit
+  has no direct Heimdall endpoint
+
 - `gamecult.heimdall.access` now has a manifest, advertisement, schemas,
   fixtures, executable `describe`/`validate`/`project` ABI, and browser
   reference adapter
@@ -138,17 +150,15 @@ Do not trust this file for the exact live HEAD. Always check git.
   configured; HTTP `/healthz`, JWKS, discovery, systemd, and nginx routing
   remain compatibility witnesses
 - Yggdrasil now runs Heimdall commit
-  `2a905354b9dc85101463030dea9045c1561a4638`. Heimdall persists its private
+  `1086aee01169bf60e8a492b2740db1c6f3e8cabf`. Heimdall persists its private
   provider-health identity at `/srv/heimdall/keys/provider-health-identity.cc`
   and publishes canonical signed health independently of the slower Verse
   snapshot cadence. Idunn owns the exact root trust binding, authenticated
   admission, lifecycle decision, and redacted public `.cc` projection.
-- Odin commit `5586910fa704b8a0d330b90a902a89b99566db77` fixes Idunn's RUDP health
-  and public-query listeners so `EINTR` retries instead of killing the
-  listener, and treats its whole-second ingress timestamp as the interval it
-  represents when checking a publisher's millisecond clock. Live proof showed
-  seven consecutive authenticated Heimdall admissions at the intended cadence
-  with both services active and zero restarts.
+- Odin commit `b4f9a2e95f0b41cebdeddc49223781d1d3c7b42a` retains the RUDP health
+  reliability cut and registers Heimdall's command-boundary, plugin, and
+  transport schemas so the typed catalog can persist rather than silently drop
+  them. Live proof returned all four exact Heimdall records.
 
 ## Critical Doctrine
 
@@ -169,10 +179,11 @@ unsigned `idunn.daemon_health`, merge its private key into Idunn, or make HTTP
 health an authority. The next product work is the Bifrost and remaining browser
 verification listed below.
 
-For the active Ghostlight cut, deploy the reviewed Heimdall and Ghostlight
-releases through Idunn. Verify Odin sees the redacted plugin/route records while
-port `4101` remains loopback-only and no token appears in CultMesh, logs, or
-browser state.
+The active Ghostlight deployment cut is complete. The next Ghostlight work is a
+real separate-account KLTST completion/refresh/logout canary, followed by the
+eight-account Session Zero privacy and actor-binding smoke. Keep port `4101`
+loopback-only and treat any claim, token, completion, app secret, or account
+state in Odin/CultMesh/browser output as a release-blocking fault.
 
 If the user asks to continue on Spotiverse, the current next move is the real
 browser `/auth/login` flow through public Heimdall. The Yggdrasil SSH tunnel

state/evidence.jsonl

@@ -32,3 +32,4 @@
 {"ts":"2026-08-20T18:32:47+00:00","type":"deployment","status":"ok","note":"Yggdrasil runs Heimdall commit 2a905354b9dc85101463030dea9045c1561a4638 with a persistent machine-bound Ed25519 provider-health identity and canonical idunn.signed_daemon_health.v1 publication. Idunn at Odin commit 5586910fa704b8a0d330b90a902a89b99566db77 has the exact root trust binding, retries interrupted UDP receives, respects whole-second ingress timestamp precision, admitted seven consecutive Heimdall pulses as authority=authenticated at the intended cadence, evaluated the daemon healthy, and maintained the redacted public provider-health .cc projection. Both services were active with zero restarts and the deployment brake engaged."}
 {"ts": "2026-08-21T22:37:58+00:00", "type": "implementation", "status": "accepted", "note": "Ghostlight auth now enters Heimdall through gamecult.heimdall.access plus a loopback CultNet operation plane. Heimdall persists attempts and completions; app-secret/source-runtime/expiry/nonce/idempotency binding and AES-256-GCM keep completion claims off public CultMesh and browser state. The plugin is projection-only and cannot grant access."}
 {"ts": "2026-08-21T23:53:15+00:00", "type": "implementation", "status": "ok", "note": "Ghostlight private auth now validates refresh against exact persisted session custody and revision; logout atomically expires that session and advances its revision, preventing stale or racing refresh from resurrecting revoked access."}
+{"ts":"2026-08-22T02:01:00+00:00","type":"deployment","status":"accepted","note":"Yggdrasil runs Heimdall 1086aee01169bf60e8a492b2740db1c6f3e8cabf with CultLib 5cefa0db0079a8e3ee22f29d7b9e6e5aa60912a9. Odin b4f9a2e95f0b41cebdeddc49223781d1d3c7b42a returns Heimdall's provider, command boundary, Eve plugin, and transport profile under unique catalog keys. Ghostlight b515ca90c25573005a616244143803b37f2d06ec accepted canonical auth.begin through the Odin-resolved boundary; only advertised Discord and Heimdall navigation origins reached the browser."}

state/map.yaml

@@ -59,7 +59,7 @@ data_flow:
     - reject per-request auth round-trip chatter
 
 active_subgoals:
-  - Migrate Ghostlight to the gamecult.heimdall.access plugin and private command plane.
+  - Pressure the deployed Ghostlight gamecult.heimdall.access integration with two- and eight-account human canaries.
   - Keep the shared architecture explicit and separate from app profiles.
   - Preserve the default boundary that app-domain data remains app-owned.
   - Align the plan to Heimdall as a Yggdrasil-hosted authority service.
@@ -93,6 +93,8 @@ accepted_design:
   - Heimdall's first runtime Verse cut publishes a service-owned CultCache boundary store and optional Idunn RUDP health pulse; full redacted auth-document witness export remains a later pass.
 
 landed_baseline:
+  - Heimdall publishes its redacted provider, command boundary, Eve plugin, and transport profile through Odin under globally unique record keys; Ghostlight resolves that boundary instead of owning a direct endpoint.
+  - Yggdrasil runs Heimdall 1086aee01169bf60e8a492b2740db1c6f3e8cabf with CultLib 5cefa0db0079a8e3ee22f29d7b9e6e5aa60912a9; live Ghostlight auth.begin through Odin discovery is accepted.
   - The Heimdall access plugin, persistent OAuth attempts, encrypted private CultNet commands, conformance fixtures, and browser reference adapter are implemented and locally verified.
   - Exact-session refresh validation and logout revocation are implemented; stale or racing refresh cannot resurrect a revoked session.
   - Shared architecture extracted into its own repo and renamed to Heimdall.
@@ -123,5 +125,5 @@ rejected_paths:
     reason: reusing auth mechanics does not justify centralizing app-domain audience or product data
 
 current_status:
-  summary: The repository contains the gamecult.heimdall.access Eve plugin, persistent auth attempts, and authenticated encrypted loopback CultNet begin, complete, refresh, and logout commands for Ghostlight. Refresh and logout are revision-bound to exact persisted session custody. The prior Yggdrasil release remains live until this commit is admitted through Idunn; signed health ownership remains unchanged.
-  next_action: Deploy this Heimdall release with the Eve-native Ghostlight release through Idunn, then verify Odin discovery, loopback-only port 4101, real KLTST authentication, refresh, logout, and secret absence from public surfaces.
+  summary: Yggdrasil runs the gamecult.heimdall.access plugin and encrypted loopback begin, complete, refresh, and logout plane at 1086aee01169bf60e8a492b2740db1c6f3e8cabf. Odin returns all four redacted discovery records, Ghostlight resolves the boundary through Odin, and live anonymous auth.begin is accepted without exposing claims or secrets.
+  next_action: Run separate-account KLTST completion, refresh, logout, privacy, and stale-attempt canaries through the deployed Ghostlight Eve host; keep provider credential rotation on the operator list because prior tool output exposed OAuth secrets.