# Ghostlight Dungeon Access Profile

Ghostlight Dungeon uses Heimdall's private CultNet authentication commands and
the `gamecult.heimdall.access` Eve plugin. Heimdall owns provider OAuth,
persistent attempts, local account identity, entitlement evaluation, signed
access claims, completion redemption, refresh, and exact-session revocation. Ghostlight verifies claims
locally and owns app sessions, campaigns, campaign membership, current campaign
selection, and every world mutation.

## App identity

- `app_slug`: `ghostlight`
- public URL: `https://yggdrasil.gamecult.org/ghostlight/`
- identity provider: Discord
- access rule: Ghostlight supplies its configured KLTST Discord-role policy on
  the app-authenticated private boundary; Heimdall evaluates the policy and
  grants `app_access` only when it succeeds

## Capabilities

- `app_access`: shared capability granting entry to the demo
- `campaign_play`: hybrid capability; Ghostlight must also prove that the
  authenticated account owns the selected campaign

The browser never carries provider tokens or a completion code. The access
plugin stores only an opaque attempt handle. Ghostlight redeems that handle over
the encrypted loopback command plane, verifies the resulting `aud=ghostlight`
claim against Heimdall JWKS, and establishes app-local campaign authority.
Short-lived local access continues without a Heimdall round trip. Scheduled
refresh re-evaluates the Ghostlight-owned KLTST role policy; explicit logout
revokes both Ghostlight's local session and the matching Heimdall refresh
custody record.