# Heimdall

Heimdall is the planned shared auth authority for GameCult-hosted experiments.

The point is painfully simple:

- stop rebuilding Discord/Patreon login glue in every app
- keep provider OAuth, linked identities, grants, entitlements, and session
  issuance in one place
- let app runtimes verify signed claims locally so "shared auth" does not
  become "everything phones home for every request"
- keep app-domain data separate so "shared auth" does not become "shared swamp"

## Current Shape

This repo is still planning and service-contract work, not a landed auth
service yet.

Canonical docs:

- `docs/architecture.md`
- `docs/implementation-plan.md`
- `docs/app-profiles/repixelizer.md`
- `docs/app-profiles/streampixels.md`
- `state/map.yaml`
- `notes/fresh-workspace-handoff.md`

## Working Loop

1. Rehydrate from canonical state.
2. Keep identity authority central and app-domain data local.
3. Prefer a Yggdrasil-hosted shared service over duplicated per-app provider
   stacks.
4. Let app backends verify signed claims locally instead of begging Heimdall on
   every guarded route.
5. Commit finished passes before the notes start breeding.