{
  "branches": [
    {
      "id": "main",
      "hypothesis": "A shared Heimdall authority service on Yggdrasil can be reused across hosted experiments if OAuth, sessions, grants, and capability machinery are centralized while app-domain data and routine route authorization stay app-local.",
      "status": "active",
      "artifacts": [
        "state/map.yaml",
        "state/scratch.md",
        "state/evidence.jsonl",
        "docs/architecture.md",
        "docs/implementation-plan.md"
      ],
      "notes": "Current mainline. Repixelizer is the first auth-blank binding target; StreamPixels is the migration and boundary stress test."
    },
    {
      "id": "eureka/joystick-h1",
      "hypothesis": "One locked refresh primitive plus a Joystick OAuth provider in Heimdall lets StreamPixels ingest Joystick without ever presenting a provider refresh token.",
      "status": "active",
      "artifacts": [
        "state/map.yaml"
      ],
      "notes": "Campaign joystick:campaign:self, target joystick:target:r1. Hands owns code in a separate worktree."
    }
  ]
}